ClawHub
Back to skill

Security audit

finance-memory

Security checks across malware telemetry and agentic risk

Overview

This skill is not deceptive, but it sends and persists sensitive financial context to an external memory service with too little user control.

Review before installing. Use this only if you are comfortable sending financial notes, budgets, spending summaries, and inferred financial context to BlueColumn persistent memory. Prefer using it with explicit user consent, minimal/redacted data, and a clear plan for deletion or retention.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill is explicitly designed to transmit and persist sensitive financial context to an external service, but it does not require a clear user-facing warning or consent step before sending that data off-platform. Because financial notes, budgets, and spending summaries can contain highly sensitive personal information, silent transmission to third-party memory materially increases privacy, compliance, and data exposure risk.

Ssd 3

Medium
Confidence
96% confidence
Finding
The workflow instructs the agent to automatically store post-interaction summaries of financial discussions in persistent memory, creating durable retention of sensitive natural-language financial data. This is dangerous because summaries often contain account-level habits, budgets, obligations, and inferred financial status, which can later be exposed through compromise, overbroad recall, or unauthorized reuse.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.