ClawHub
Back to skill

Security audit

Rental Manager

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent rental bookkeeping helper, but it can make persistent Google Drive and Sheets changes with weak scoping around which files may be moved or renamed.

Review before installing. Use this only with a Google account limited to the intended rental folders and sheets, and require confirmation before any receipt upload, Drive rename or move, or spreadsheet update. The handler should validate that file IDs come from a trusted upload/staging location and should check the spreadsheet index before changing Drive files.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/handle_receipt_upload.py:62
Finding

Caller-Controlled File ID Permits Unauthorized Google Drive File Mutation

Content
View full analysis
dict: try: # 1. Get folder ID target_folder_id = get_folder_id(property_name) # 2. Determine final file name file_extension = Path(original_file_name).suffix if desired_file_name: final_name = desired_file_name elif excel_index: final_name = f"{excel_index}{file_extension}" else: return {"success": False, "error": "Cannot determine final file name. Please provide excel_index or desired_file_name."} # 3. Move and rename file in Drive # gog drive move --parent subprocess.run(["gog", "drive", "move", file_id, "--parent", target_folder_id], capture_output=True, text=True, check=True) # gog drive rename subprocess.run(["gog", "drive", "rename", file_id, final_name], capture_output=True, text=True, check=True) # 4. Get webViewLink (need to search again by ID as rename might change some metadata) cmd_get_link = ["gog", "drive", "get", file_id, "--json", "--select", "file(webViewLink)"] result_link = subprocess.run(cmd_get_link, capture_output=True, text=True, check=True) file_link = json.loads(result_link.stdout).get("file", {}).get("webViewLink", "") # 5. Update Excel sheet if excel_index: sheet_id = get_sheet_id(property_name) tab_name = get_sheet_tab_name(property_name) # Find the row for the given index # Assuming index is in column A and data starts from row 2 cmd_get_all_data = ["gog", "shee ...[truncated 3511 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
74% confidence
Finding

The skill appears capable of performing operational actions while declaring no explicit tool scope or permissions boundary. In a bookkeeping skill that references Drive uploads and spreadsheet updates, this increases the risk of unintended or overbroad tool access, making it harder to constrain file, shell, or data-modification behavior if the agent runtime infers capabilities implicitly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list includes broad terms such as property names and generic bookkeeping phrases, which can cause the skill to activate in contexts the user did not intend. Because this skill can modify spreadsheet records and upload receipts to Drive, accidental invocation could lead to unauthorized data changes, disclosure, or misfiling of financial documents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill description and workflow do not clearly warn that using the receipt workflow will upload files to Google Drive and modify spreadsheet entries. In a financial recordkeeping context, this weakens informed user consent and increases the chance that sensitive receipts, tax records, or links are stored or altered without the user's clear understanding.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/handle_receipt_upload.py (reported line 48)May include surrounding context.

python
def get_next_index(sheet_id: str, tab_name: str) -> int:
    cmd = ["gog", "sheets", "get", sheet_id, f"{tab_name}!A:A", "--json"]
    result = subprocess.run(cmd, capture_output=True, text=True, check=True)
    data = json.loads(result.stdout).get("values", [])
    
    max_index = 0

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/handle_receipt_upload.py (reported line 75)May include surrounding context.

python
# 3. Move and rename file in Drive
        # gog drive move <fileId> --parent <newParentId>
        subprocess.run(["gog", "drive", "move", file_id, "--parent", target_folder_id], capture_output=True, text=True, check=True)
        # gog drive rename <fileId> <newName>
        subprocess.run(["gog", "drive", "rename", file_id, final_name], capture_output=True, text=True, check=True)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code performs state-changing operations by moving and renaming a file in Google Drive and then updating a Google Sheet, but there is no confirmation prompt, user-visible logging, or warning comment/docstring describing these effects. For a code file, these are file/data modification actions that should include some form of disclosure unless documented elsewhere in markdown, which is not present in this file.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/handle_receipt_upload.py (reported line 77)May include surrounding context.

python
# gog drive move <fileId> --parent <newParentId>
        subprocess.run(["gog", "drive", "move", file_id, "--parent", target_folder_id], capture_output=True, text=True, check=True)
        # gog drive rename <fileId> <newName>
        subprocess.run(["gog", "drive", "rename", file_id, final_name], capture_output=True, text=True, check=True)

        # 4. Get webViewLink (need to search again by ID as rename might change some metadata)
        cmd_get_link = ["gog", "drive", "get", file_id, "--json", "--select", "file(webViewLink)"]

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/handle_receipt_upload.py (reported line 81)May include surrounding context.

python
# 4. Get webViewLink (need to search again by ID as rename might change some metadata)
        cmd_get_link = ["gog", "drive", "get", file_id, "--json", "--select", "file(webViewLink)"]
        result_link = subprocess.run(cmd_get_link, capture_output=True, text=True, check=True)
        file_link = json.loads(result_link.stdout).get("file", {}).get("webViewLink", "")

        # 5. Update Excel sheet

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/handle_receipt_upload.py (reported line 92)May include surrounding context.

python
# Find the row for the given index
            # Assuming index is in column A and data starts from row 2
            cmd_get_all_data = ["gog", "sheets", "get", sheet_id, f"{tab_name}!A2:A100", "--json"]
            all_data_result = subprocess.run(cmd_get_all_data, capture_output=True, text=True, check=True)
            all_data = json.loads(all_data_result.stdout).get("values", [])
            
            target_row_number = -1

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
89% confidence
Finding

This line writes file_link into Google Sheets using USER_ENTERED mode, which can cause values beginning with '=' or similar formula prefixes to be interpreted as formulas rather than plain text. If an attacker can influence the written link or metadata upstream, this can become a spreadsheet formula injection issue that may exfiltrate data, create malicious hyperlinks, or manipulate sheet contents when viewed.

Content

Scanner excerpt · scripts/handle_receipt_upload.py (reported line 105)May include surrounding context.

python
# Update G column (7th column) with the link
                update_range = f"{tab_name}!G{target_row_number}"
                cmd_update_sheet = ["gog", "sheets", "update", sheet_id, update_range, file_link, "--json", "--input=USER_ENTERED"]
                subprocess.run(cmd_update_sheet, capture_output=True, text=True, check=True)
                return {"success": True, "file_link": file_link, "message": f"File {final_name} processed and linked in Excel."}
            else:
                return {"success": False, "error": f"Index {excel_index} not found in Excel tab {tab_name}."}