ClawHub
Back to skill

Security audit

Mortgage

Security checks for vulnerabilities and agentic risk

Overview

This mortgage skill is not malicious, but it needs review because it handles sensitive financial decisions with broad activation and some unclear boundaries.

Install only if you are comfortable using it as an educational organizer, not as mortgage or lender advice. Treat calculations and lender comparisons as rough, user-supplied summaries, avoid entering unnecessary sensitive financial details, and verify decisions with a licensed mortgage professional.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The skill’s declared boundaries and its described behaviors are inconsistent: it claims educational-only guidance and no mortgage advice, yet it offers affordability outputs and lender comparison workflows that can functionally influence financial decisions. This mismatch can mislead users and downstream agents into overtrusting the skill, causing it to be invoked in situations where regulated or higher-risk guidance should be avoided.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The trigger phrases are broad enough to match ordinary conversations about home buying and personal finances, which increases the chance of over-invocation. In this context, unnecessary activation could expose sensitive financial information to local storage or cause the skill to provide influential financial guidance when the user only wanted general conversation.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The file says it will never recommend specific lenders, but it includes lender comparison workflows and stores lender-specific notes. Even without an explicit 'recommendation' command, comparative presentation can nudge users toward a particular lender, undermining the stated safety boundary and creating compliance and trust risks.

Intent-Code Divergence

Low
Confidence
72% confidence
Finding
L015-L016 state there is no connection to lender systems and no application submissions, yet the workflow at L067-L071 says tracking an application by ID will show the current stage and next steps. Without lender connectivity, that wording suggests a capability the documented constraints prohibit, creating a documentation-level contradiction about how tracking works.

Static analysis

No suspicious patterns detected.