ClawHub
Back to skill

Security audit

Cashclaw Core

Security checks for vulnerabilities and agentic risk

Overview

This skill fits its business-automation purpose, but it stores sensitive client and payment-related data locally and installs an unpinned npm executable without enough safeguards.

Install only if you are comfortable with a business automation skill writing client, billing, deliverable, and configuration data under `~/.cashclaw/`, sending client-facing messages and payment artifacts, and installing the current npm `cashclaw` executable. Prefer a pinned and reviewed package version, restrict file permissions, avoid storing secrets or raw client messages, and require explicit confirmation before invoices, payment links, reminders, followups, or deliverables are sent.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:10
Finding

Unpinned Third-Party npm Executable Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–19
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

Vulnerable Code:

json
"install":
  [
    {
      "id": "npm",
      "kind": "node",
      "package": "cashclaw",
      "bins": ["cashclaw"],
      "label": "Install CashClaw via npm"
    }
  ]

Technical Analysis

The installation metadata requests the npm package cashclaw without an exact version, package integrity hash, lockfile, verified source repository, or publisher identity. Consequently, the code installed and executed can change independently of the reviewed skill.

npm packages can execute lifecycle scripts during installation and expose executable binaries, as this package does through the cashclaw binary. Although the audited file does not establish that the current package is malicious, this configuration creates an avoidable supply-chain exposure. Package publisher compromise, account takeover, malicious future releases, or registry substitution could cause arbitrary code to run under the installing user's account.

Attack Path

  1. An attacker compromises the npm publisher account, package repository, or release pipeline associated with cashclaw.
  2. The attacker publishes a malicious version under the same package name.
  3. A user or agent installs the dependency using the unversioned package declaration.
  4. npm resolves the declaration to the attacker-controlled release.
  5. Malicious installation lifecycle code or the installed cashclaw executable runs locally.
  6. The payload accesses or modifies resources available to the installing user, including CashClaw configuration, mission records, client data, and credentials readable by that account.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user installing or invoking the package. The affected scope may incl ...[truncated 525 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin cashclaw to a specifically reviewed version rather than allowing npm to resolve the latest release.
  2. Enforce a lockfile and verify the package tarball using an expected integrity hash.
  3. Document and validate the canonical source repository and expected npm publisher.
  4. Review the pinned package's lifecycle scripts, executable entry points, dependencies, and transitive dependencies before deployment.
  5. Disable npm lifecycle scripts during installation where operationally feasible, for example by using an appropriate ignore-scripts policy.
  6. Install and execute the package inside a sandbox or restricted service account with minimal filesystem, credential, subprocess, and network access.
  7. Use dependency monitoring and require manual security review before updating the pinned version.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:38
Finding

Raw Client Requests and Business Data Are Persisted Without Defined Protection Controls

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38–56
Vulnerability Type: Insecure storage of potentially sensitive data
Risk Level: Low

Vulnerable Code:

markdown
1. Parse the client message for: service type, scope, deadline, budget hints.
2. Create a mission file at `~/.cashclaw/missions/MISSION-{YYYYMMDD}-{SEQ}.md`.
3. Log the intake in `~/.cashclaw/ledger.jsonl` with status `intake`.
4. Identify which CashClaw skill(s) are needed.
5. Ask clarifying questions if scope is ambiguous. Never assume; always confirm.

Mission file template:

```markdown
# MISSION-{YYYYMMDD}-{SEQ}
- Client: {name}
- Service: {type}
- Status: INTAKE
- Created: {ISO8601}
- Deadline: {ISO8601 or TBD}
- Price: {pending}
- Skill: {cashclaw-skill-name}
- Notes: {raw client request}
text

Related storage instructions at `SKILL.md:176–191` also define persistent locations for API configuration, client profiles, history, preferences, mission logs, and deliverables.

### Technical Analysis

The workflow explicitly places the unredacted client request into a Markdown mission file. It also directs the agent to maintain client profiles, histories, logs, deliverables, invoices, and revenue information beneath the predictable `~/.cashclaw/` path.

Markdown and JSONL records are ordinarily plaintext files. The skill does not define restrictive filesystem permissions, encryption at rest, data classification, sensitive-field redaction, retention limits, secure deletion, or controls limiting which delegated skills may access these records. Raw client messages and generated deliverables may contain personal information, confidential business information, access tokens, or other secrets supplied unintentionally.

### Attack Path

1. A client includes personal, confidential, or credential-like information in a service request.
2. The skill copies the complete request into the mission file as `{raw client request}
...[truncated 1052 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not persist the complete raw client request by default. Extract only the minimum fields required to complete the mission.
  2. Redact passwords, access tokens, API keys, payment data, government identifiers, and other sensitive values before writing records or logs.
  3. Create ~/.cashclaw/ directories and files with restrictive owner-only permissions, and validate permissions before processing client information.
  4. Encrypt sensitive mission, client, and configuration records at rest using a key stored separately from the data.
  5. Separate credentials and payment configuration from general mission records, and expose them only to the component that requires them.
  6. Restrict delegated skills to mission-specific directories rather than providing broad access to the entire CashClaw data directory.
  7. Establish retention periods for mission files, client histories, logs, and deliverables, followed by secure deletion.
  8. Add explicit guidance instructing clients not to provide passwords, full payment-card data, or unnecessary personal information.
  9. Prevent sensitive records from entering unencrypted backups and add audit logging for access to client and mission data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

This is a clear session-persistence behavior: the skill mandates creation of mission files and ledger entries tied to client interactions in a fixed home-directory location. In context, the persistence is operational rather than overtly malicious, but it is still security-relevant because it establishes durable storage of potentially sensitive conversation and business data without safeguards or consent.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md
When a new client request arrives:

1. Parse the client message for: service type, scope, deadline, budget hints.
2. Create a mission file at `~/.cashclaw/missions/MISSION-{YYYYMMDD}-{SEQ}.md`.
3. Log the intake in `~/.cashclaw/ledger.jsonl` with status `intake`.
4. Identify which CashClaw skill(s) are needed.
5. Ask clarifying questions if scope is ambiguous. Never assume; always confirm.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly directs the agent to persist raw client requests, mission metadata, and logs under ~/.cashclaw without any consent, disclosure, minimization, or retention controls. Even if intended for normal business workflow, this creates privacy and security risk because sensitive client data may be stored indefinitely on disk and later exposed to other local processes, backups, or users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs generating payment links and invoices through another skill and potentially Stripe, but does not require disclosure that client identity, billing details, or transaction metadata may be sent to an external payment processor. This is dangerous because users may unknowingly authorize third-party transmission of sensitive commercial or personal information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The delivery workflow tells the agent to send deliverables to clients but does not warn that generated outputs may contain client data or that transmission may occur over external channels. This can lead to unintended disclosure of confidential content, especially where deliverables include analysis artifacts, logs, or embedded sensitive details.

Content

No source excerpt is available for this finding.