Just Fucking Cancel

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:49 AM UTC
• Version: 1.2.0

Overview

This subscription-audit skill is coherent and disclosed, but users should treat its financial data and optional Plaid credential handling as sensitive.

Install only if you are comfortable letting the agent process bank transaction exports. Prefer the CSV workflow for local analysis, avoid configuring Plaid credentials unless you trust the runtime and secret handling, and review generated reports before sharing or copying selected subscription details.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: PUBLISH.md:10

Finding

Unpinned Global CLI Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: PUBLISH.md, lines 10–12
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

bash

# 1. Install ClawdHub CLI (if not already)
npm i -g clawdhub

Technical Analysis

The publishing instructions install the latest available version of the clawdhub npm package globally without pinning a reviewed version or verifying package integrity or provenance.

Because npm packages may execute lifecycle scripts during installation, the effective code executed by this command can change after this project has been audited. Global installation also makes the package and its executables available outside the project environment. The resulting exposure depends on the privileges of the user running npm.

No evidence establishes that the current clawdhub package is malicious. The vulnerability is the unsafe, mutable dependency-installation practice.

Attack Path

1. An attacker compromises the npm package, its publisher account, or its release process.
2. The attacker publishes a malicious version under the expected package name.
3. A user follows PUBLISH.md and runs npm i -g clawdhub.
4. npm retrieves the mutable latest release rather than a previously reviewed version.
5. Malicious lifecycle or CLI code executes with the privileges of the invoking user.
6. The globally installed executable remains available for later invocations until removed or replaced.

Impact Assessment

A compromised dependency could execute arbitrary code with the invoking user's privileges. Depending on those privileges and the host environment, it could access user-readable files and credentials, alter user-owned configuration, tamper with publishing operations, install or replace globally available tooling, and affect projects that subsequently invoke the CLI.

The instruction does not itself request elevated privileges, so administrative or root-level impact is not e ...[truncated 70 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a specifically reviewed release:

   bash

   npm install --global clawdhub@<reviewed-version>
   

2. Document the authoritative package registry, publisher identity, and expected package metadata so users can detect similarly named or substituted packages.

3. Verify npm provenance, release signatures, or published integrity information before installation.

4. Review the pinned package's lifecycle scripts and transitive dependency tree.

5. Prefer a project-local, lockfile-controlled installation where the publishing workflow supports it, rather than modifying the global tool environment.

6. Run the installation as a non-privileged user in an isolated build or publishing environment.

7. Establish a controlled update process in which new versions are reviewed and deliberately pinned before adoption.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The skill explicitly declares support for highly sensitive Plaid credentials, including a secret and access token tied to a user's bank connection. Even though this is framed as optional integration, prompting for or handling these secrets inside a general-purpose agent skill creates a significant credential-exposure risk if logs, prompts, reports, or downstream tools capture them.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

description: Plaid secret key (optional - only needed for Plaid integration)
    required: false
  - name: PLAID_ACCESS_TOKEN
    description: User's Plaid access token for their connected bank account (optional)
    required: false
triggers:
  - cancel subscriptions

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This section instructs use of Plaid credentials and states that transaction data is sent to Plaid's servers, confirming external transmission of sensitive financial data. In skill context, that makes the credential-access concern more dangerous because the workflow normalizes providing banking tokens to the agent environment rather than a dedicated secure connector.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

**Important**: This requires Plaid credentials and sends data to Plaid's servers:
- `PLAID_CLIENT_ID` - Your Plaid client ID
- `PLAID_SECRET` - Your Plaid secret key
- `PLAID_ACCESS_TOKEN` - Access token for the bank connection

**Privacy note**: When using Plaid, transaction data is transmitted to Plaid's API. CSV analysis is fully local.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The publish description advertises analysis of bank CSV exports and browser automation for cancellations, but it does not include any explicit warning that the skill handles sensitive financial data and may take account-impacting actions. In a marketplace or install context, this can cause users to invoke the skill without understanding the privacy implications or the risk of unintended subscription cancellations.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 86% confidence

Finding

The trigger 'save money' overlaps with a common built-in intent and ordinary user speech, creating a shadowing risk where this finance skill may intercept unrelated requests. In this skill's context, unintended activation is more concerning because it can steer users into sharing transaction data or discussing financial accounts when they only asked for generic savings advice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase set is broad for a finance skill, and phrases like 'what am I paying for' and 'save money' can plausibly match ordinary conversation outside an explicit request to run a subscription-audit workflow. That can cause unintended invocation in contexts involving sensitive financial discussion, increasing the chance the agent prompts for bank data or activates the skill when the user did not mean to.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The copyChecked() function copies selected service names and billing amounts to the system clipboard, which can expose personal financial or subscription information outside the page context. Although the action is triggered by a button click, the file provides no explicit warning or disclosure that sensitive data will be placed on the clipboard.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.