ClawHub
Back to skill

Security audit

finance-memory

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent finance-memory purpose, but it tells agents to persist sensitive financial context to an external service automatically without clear user approval or retention controls.

Review this skill carefully before installing. Only use it if you are comfortable sending finance-related summaries to BlueColumn's external persistent memory service, and avoid storing account numbers, credentials, transaction identifiers, tax details, or other highly sensitive information unless the service's retention and deletion controls are clear.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:8
Finding

Automatic External Persistence of Sensitive Financial Context Without Explicit Consent

Content
View full analysis
" \ -H "Content-Type: application/json" \ -d '{"text": "Budget Jul: $4k, spent $3.2k. Subscriptions: $89/mo total.", "title": "finance-memory - note"}' ``` ## Quick note ```bash curl -X POST .../agent-note \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{"text": "Budget Jul: $4k, spent $3.2k. Subscriptions: $89/mo total.", "tags": ["finance-memory"]}' ``` ## Workflow 1. On new context, first recall: `What's my spending trend this quarter?` 2. Use the answer to personalize the response 3. After the interaction, store the summary via `/agent-remember` ``` ### Technical Analysis The skill instructs the agent to send financial context to an external Supabase-hosted API and persist a summary after an interaction. Financial discussions can contain highly sensitive information, including budgets, transaction details, income, debts, subscriptions, account references, and personally identifying information. The workflow does not require the agent to: - Obtain explicit user consent before transmitting or persisting information. - Present the exact content that will be sent for user approval. - Minimize or redact sensitive fields. - Exclude credentials, account numbers, transaction identifiers, or personal data. - Explain retention, deletion, access-control, or data-governance policies. - Confirm that the user intends storage during every relevant interaction. ...[truncated 2247 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill handles highly sensitive financial data but does not clearly warn that user-provided finance information will be transmitted to BlueColumn and stored in persistent external memory. This creates a meaningful privacy and compliance risk because users and downstream agents may disclose budgets, spending history, or account-related context without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The skill explicitly sends financial content to an external API endpoint using an authorization token, which is a genuine external-transmission risk. While external storage is the stated function of the skill, the danger is elevated because the transmitted content consists of sensitive financial information and the documentation does not pair transmission with strong consent, minimization, or handling safeguards.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Store

bash
curl -X POST .../agent-remember \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{"text": "Budget Jul: $4k, spent $3.2k. Subscriptions: $89/mo total.", "title": "finance-memory - note"}'

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The workflow instructs the agent to store a finance summary after every interaction, which encourages automatic retention of conversation-derived sensitive data. In a financial context, this can accumulate detailed spending patterns, budget history, and inferred personal information, increasing the blast radius of compromise, misuse, or over-collection.

Content

No source excerpt is available for this finding.