ClawHub

Expense Tracker

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent local expense tracker, but users should know it writes personal spending records to local markdown files and has broad logging examples.

Install only if you want an agent to maintain a local expense log. Keep entries free of sensitive details you do not want stored, review the generated files for accuracy, and use explicit requests like 'log this expense' rather than casual spending comments. Avoid supplying unusual --workspace, --date, or month values unless you trust the path being used.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill instructs the agent to read and write workspace files (`expenses/*.md`) but does not declare corresponding permissions. This creates a transparency and policy gap: the skill can persist user financial data without an explicit permission contract, increasing the risk of unexpected data modification or storage.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The description includes broad activation terms like viewing summaries, analyzing spending patterns, and managing personal finance tracking, which can cause the skill to trigger on general finance conversations rather than explicit expense-logging requests. Unintended invocation is risky here because the skill has file read/write behavior and may persist sensitive personal-finance data.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The workflow trigger 'When the user mentions spending money' is overly vague and may match casual statements rather than requests to record expenses. In context, that can lead to silent or premature logging of sensitive financial activity into persistent files without sufficiently explicit consent.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal