Subscription Killer

• Verdict: Pass
• Confidence: Medium
• Analyzed: May 5, 2026, 3:46 PM
• Findings: 3
• Version: 1.3.0

Overview

This skill is coherently designed to analyze a user-provided bank CSV locally, but users should notice that it handles sensitive financial data and has minor provenance/version-documentation gaps.

This appears safe to use for its intended purpose if you are comfortable giving the agent/script a bank transaction CSV. Review the exact script/package version first, run it locally, and provide only the specific CSV you want analyzed.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

NoteHigh Confidence

What this means

The script can process the bank CSV file you point it at and include transaction-derived information in its report.

Why it was flagged

The skill expects local Python execution against a file path supplied by the user. This is purpose-aligned, but it means the agent/script can read the specified CSV.

Skill content

Usage:
    python3 subscription_killer.py --file transactions.csv

Recommendation

Run it only on the intended bank export, preferably in a local trusted workspace, and do not provide broader file paths than needed.

ASI04: Agentic Supply Chain Vulnerabilities

NoteMedium Confidence

What this means

It is harder to independently confirm that the reviewed script exactly matches the intended release.

Why it was flagged

The registry lacks a public source/homepage, and the provided SKILL.md/script labels show version 1.1.0, creating a minor provenance and release-label mismatch.

Skill content

Source: unknown; Homepage: none; Version: 1.3.0

Recommendation

Verify the package source or maintainer if possible, and review the local script before running it on real bank data.

ASI06: Memory and Context Poisoning

NoteHigh Confidence

What this means

Personal financial details may be visible to the agent session and in the generated report.

Why it was flagged

Bank transaction exports can reveal merchants, spending habits, dates, and amounts. The artifacts show local analysis and reporting, not persistence or transmission, but the data is still sensitive.

Skill content

The skill accepts any CSV export from a personal bank account.

Recommendation

Use only the minimum necessary CSV, redact unrelated rows if possible, and avoid sharing the generated report publicly.