ClawHub
Back to skill

Security audit

发票信息整理与清单

Security checks across malware telemetry and agentic risk

Overview

This invoice-organizer skill uses local PDF and project files in ways that match its disclosed reimbursement workflow, with no hidden network, deletion, credential, or persistence behavior.

Install only if you are comfortable letting the agent read the invoice PDFs you provide and nearby project information files used to match clients, case details, dates, and reimbursement reasons. Prefer giving it the exact invoice files and project root, and review any copied filing destination or generated reimbursement list before relying on it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill instructs the agent to read local files and invoke shell commands (`pdftotext`, Python scripts) but declares no explicit permissions or capability boundaries. This creates an authorization gap: a caller may not realize the skill can access filesystem content and execute local tooling, increasing the risk of over-broad file access or command use in sensitive workspaces.

Tp4

High
Category
MCP Tool Poisoning
Confidence
80% confidence
Finding
The documented purpose is invoice organization, but the workflow also includes traversing upward from a file path, reading project information files, and enumerating directory structure to infer context. That broader behavior can expose unrelated project metadata and workspace structure beyond the minimum needed for invoice processing, making data leakage more likely in environments containing confidential client matters.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.