Clawhub Pkg

• Outcome: Review
• Latest audit: Aug 27, 2026 · 7:00 PM UTC
• Version: 0.2.0

Overview

This bookkeeping skill is purpose-built for accounting, but it needs Review because it claims local-only processing while one import path can send financial documents to Anthropic and some file/export actions are broader than the stated workspace boundary.

Install only if you are comfortable treating this as a high-authority local accounting application. Set GRIDTRX_WORKSPACE narrowly, avoid the PDF/image/Excel AJE extraction path unless the user explicitly approves sending the document to Anthropic, review AI-extracted entries before posting, and keep write-up exports inside the client workspace. Use the browser UI only on a trusted local machine and be cautious with workpaper file-open actions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if sysname == 'Windows':
            os.startfile(p)          # type: ignore[attr-defined]
        elif sysname == 'Darwin':
            subprocess.Popen(['open', p])
        else:
            subprocess.Popen(['xdg-open', p],
                             stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

• Confidence: 95% confidence
• Finding: This endpoint launches a user-linked file in the OS default application via `open`. Even though the path is containment-checked through `models.wp_resolve`, the feature still enables remote triggering of local application execution from the web UI, which can open risky file types or invoke helper apps/protocol handlers on the host.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

elif sysname == 'Darwin':
            subprocess.Popen(['open', p])
        else:
            subprocess.Popen(['xdg-open', p],
                             stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        return jsonify({'ok': True, 'opened': True})
    except Exception as e:

• Confidence: 95% confidence
• Finding: This Linux branch invokes `xdg-open` on a path derived from workpaper metadata. `xdg-open` delegates to the desktop's handler for the file or URI, so a web request can cause the host to open arbitrary local content in external applications, expanding the attack surface beyond the Flask app itself.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if sysname == 'Windows':
            os.startfile(p)          # type: ignore[attr-defined]
        elif sysname == 'Darwin':
            subprocess.Popen(['open', p])
        else:
            subprocess.Popen(['xdg-open', p],
                             stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

• Confidence: 95% confidence
• Finding: This second file-open endpoint repeats the same dangerous pattern: a web-triggerable action starts the OS default application for a linked file. In a localhost app used by agents or browsers, any cross-site request or UI abuse could cause unexpected local program execution on the operator's machine.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

elif sysname == 'Darwin':
            subprocess.Popen(['open', p])
        else:
            subprocess.Popen(['xdg-open', p],
                             stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        return jsonify({'ok': True})
    except Exception as e:

• Confidence: 95% confidence
• Finding: The `xdg-open` variant has the same issue as the macOS branch: it hands untrusted file selection to the OS launcher. This is especially risky because desktop handlers may execute or preview complex formats with known parser bugs, turning a simple open into code execution in another program.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: The documented skill describes a local-only accounting tool, but the finding indicates the underlying package may also expose substantially broader behaviors, including external API calls, web serving, OS file-opening/integration, and import/export features not disclosed in the skill. That mismatch is dangerous because an agent or user may grant trust and sensitive financial data access under the assumption of strictly local processing, while hidden or undocumented paths could exfiltrate data or expand the attack surface.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The script base64-encodes PDFs/images and sends spreadsheet/CSV text to Anthropic for extraction, which directly contradicts the skill's stated 'all data stays in a single local SQLite file' behavior. In an accounting context, these files can contain highly sensitive financial records, so undisclosed off-device transmission creates a substantial confidentiality and compliance risk.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This code introduces dependency on a third-party network AI service and API credentials for document processing despite the surrounding skill being presented as a local accounting suite. While using an environment variable for an API key is normal by itself, the undisclosed remote dependency expands the trust boundary and can expose financial data to external infrastructure and operational failures.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill metadata describes a local-file accounting conversion tool, but this file exposes a full browser-hosted bookkeeping application with broad mutation capabilities. That larger-than-advertised capability increases attack surface substantially for an agent environment, especially when a caller may expect simple file conversion rather than long-lived UI, server, and stateful bookkeeping operations.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This code opens arbitrary linked files in OS-default applications from HTTP-triggered endpoints. In skill context, that is more dangerous than usual because an agent-facing tool should not be able to launch local apps or files on the host merely from web/API actions; it crosses from data processing into host interaction and potential local code execution chains.

Context-Inappropriate Capability

High

• Confidence: 90% confidence
• Finding: The application spawns local browser processes to present its UI. In a normal desktop app this may be acceptable, but for an agent skill this is a strong boundary violation: executing host GUI programs and starting a long-lived localhost server is far beyond passive accounting-file conversion and can be abused to persist, confuse operators, or alter host state unexpectedly.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The CLI exposes an export path that emits a highly sensitive write-up bundle containing fully itemized current/prior-year transactions, five years of comparatives, chart metadata, and validation output for an external program. In an agent-facing skill, this materially expands data exfiltration surface beyond routine bookkeeping commands, especially because the command is easy to invoke and produces a consolidated JSON payload suitable for downstream transfer.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill metadata and module docstring emphasize that client accounting data stays local in a single SQLite file, but import_aje explicitly documents support for PDF/image/Excel extraction via an Anthropic API path. That creates a confidentiality and trust-boundary violation: sensitive financial documents may be transmitted off-host to a third-party service contrary to the stated local-only design, which is especially dangerous in an accounting context handling client financial records.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: This tool exposes external AI/API-based document extraction capability inside an accounting MCP server whose stated purpose is local bookkeeping. Even if technically functional, embedding a remote document-processing path broadens the attack and data-exposure surface: uploaded AJE source files can contain tax, payroll, banking, and client-identifying information that should not be sent to external services without strict controls.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: export_writeup writes a comprehensive JSON export containing current/prior year details, comparatives, chart mappings, and validation results directly to out_path without calling _check_path. That bypasses the workspace boundary described in the server contract, allowing an agent or caller to write sensitive financial data to arbitrary filesystem locations, increasing risk of data leakage, accidental overwrite, or exfiltration staging.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: `export_writeup()` exports two full years of itemized transactions plus five years of comparative account history and operational metadata in one payload. For an accounting skill whose description emphasizes local bookkeeping in a single SQLite file, this broad export materially increases data exposure and creates an easy path for over-sharing sensitive financial history if consumed by another tool or agent.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The README instructs users to tell an agent to 'Read SKILL.md and do my books,' which is a broad natural-language activation phrase for a high-impact domain. Because bookkeeping tasks can include imports, rule changes, deletions, re-imports, and report generation, this phrasing may cause an agent to begin consequential actions without explicit scoping, confirmation boundaries, or a defined client/workspace context.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The instruction to run checks 'when you pick up a file and again before reporting work finished' is broad and underspecified for an autonomous agent handling sensitive accounting files. Without tighter trigger boundaries and approval requirements, an agent may perform unplanned file access or operational steps in contexts the user did not intend, increasing the chance of privacy, workflow, or integrity issues.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The call to client.messages.create transmits document contents to Anthropic without any user-facing notice, consent flow, or confirmation at the point of use. Because the files are AJEs, bank/accounting spreadsheets, PDFs, or images, the transmitted content is likely sensitive financial information, making silent exfiltration to a SaaS provider especially risky in this skill context.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: `import_structure` relies on a form field for confirmation but performs destructive replacement of reports, report items, tax codes, rules, and potentially accounts without an in-code safety interlock tied to intent or freshness. If triggered unintentionally or via request forgery, it can irreversibly wipe bookkeeping structure in the open file.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The data import path temporarily clears the lock date, weakening an accounting control designed to prevent back-posting into closed periods. Even if restored later, any failure mode, concurrent action, or unexpected request during that window can bypass the guard invisibly and import historical entries that policy was meant to block.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The write-up export writes sensitive accounting data to a user-supplied filename without enforcing the GRIDTRX_WORKSPACE boundary that protects most other file operations. An agent or user can therefore save multi-year financial data to arbitrary filesystem locations, increasing the risk of unintended disclosure, overwrite of unrelated files, or staging data for exfiltration.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The export_writeup function emits a highly sensitive JSON handoff file but neither enforces the documented workspace restriction nor surfaces a user-facing warning at the write point. In an agent setting, that makes silent sensitive-data export easier because the write operation looks like an ordinary local helper while actually enabling unrestricted file placement.

Unvalidated Output Injection

High

• Category: Output Handling

Content

if not os.path.exists(script_path):
            raise ValueError(f"aje_extract.py not found at {script_path}")

        result = subprocess.run(
            [sys.executable, script_path, file_path],
            capture_output=True, text=True, timeout=120
        )

• Confidence: 82% confidence
• Finding: The code blindly parses `result.stdout` from `aje_extract.py` as JSON and uses the extracted entries to drive accounting postings. Because the helper is an external execution boundary, any compromise, malfunction, or maliciously crafted output from that helper can inject falsified accounting data into the local books, making this an untrusted-output trust-boundary issue rather than classic command injection.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

flask
mcp

• Confidence: 97% confidence
• Finding: The dependency 'flask' is unpinned, so installs can resolve to different versions over time, including newly introduced breaking changes or vulnerable releases. In an agent skill that may process financial data and expose local services, this weakens build reproducibility and increases supply-chain risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

flask
mcp

• Confidence: 98% confidence
• Finding: The dependency 'mcp' is also unpinned, allowing the environment to install whatever version is latest at build time. Because MCP libraries often mediate tool/server communication for AI agents, unpinned versions can unexpectedly introduce security-relevant behavior changes or pull in versions with serious known flaws.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: app.py:28