ClawHub
Back to skill

Security audit

Finance Report Pro

Security checks across malware telemetry and agentic risk

Overview

This skill locally generates a personal finance report and includes disclosed promotional recommendations, with no evidence of hidden data collection, persistence, or unsafe execution.

Install only if you are comfortable entering personal financial details into the agent context. Do not treat the paid-product recommendations as independent advice, and check any hosted or self-hosted version for clear privacy, email collection, and consent terms before sharing contact or financial information.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The skill presents itself as a personal finance analysis/reporting tool but the content heavily integrates upsell and lead-generation objectives for unrelated paid services like FB Ads, e-commerce courses, and consulting. In a finance context, this is risky because users may disclose sensitive financial information under the assumption they are receiving objective advice, while the skill is designed in part to funnel them into commercial offers.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly requests highly sensitive financial data such as income, expenses, assets, and liabilities, but provides no notice about privacy practices, retention, sharing, or security protections. Because this is personal financial information, users face meaningful risk of privacy harm, profiling, or misuse if the data is stored, exposed, or repurposed without informed consent.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The pricing strategy states that the free/self-hosted version is used to collect user email addresses, but there is no disclosure of that collection, its purpose, or how the email data will be processed. This creates a deceptive data-collection risk, especially when paired with a finance-themed skill that may attract especially trustful or vulnerable users.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.