ClawHub
Back to skill

Security audit

Financial Tracker

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a local finance tracker, but an advanced setup shows a recurring task that can send financial summaries to Telegram despite local-only privacy claims.

Review the advanced automation carefully before installing or using it. The basic tracker is local and purpose-aligned, but do not run the cron example with --announce/--to unless you intentionally want recurring financial summaries sent to that destination and know how to remove the scheduled task.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T06 · System Persistence

Error
Location
references/advanced-patterns.md:70
Finding

Persistent Scheduled Transmission of Financial Summaries

Content
View full analysis

Vulnerability Details

File Location: references/advanced-patterns.md, lines 70–81
Vulnerability Type: T06: System Persistence
Risk Level: High

The skill provides instructions for installing a recurring OpenClaw cron task that reads local financial records, generates a profit-and-loss summary, and announces that summary to a configured Telegram chat.

Complete Vulnerable Code Snippet:

bash
openclaw cron add \
  --name "month-end-close" \
  --cron "0 18 28-31 * *" \
  --model "anthropic/claude-haiku-3-5" \
  --session isolated \
  --message "Check if today is the last day of the month. If yes, run the month-end close: generate P&L from finance/income-log.md and finance/expense-log.md, append to finance/monthly-summary.md, update finance-state.json, and send me a summary." \
  --announce \
  --to "[YOUR_TELEGRAM_CHAT_ID]" \
  --tz "America/Chicago"

Technical Analysis

The openclaw cron add command creates a scheduled task that persists beyond the current agent session. It executes between the 28th and 31st day of every month and checks whether it should perform the month-end close.

The scheduled prompt explicitly directs the agent to:

  1. Read finance/income-log.md and finance/expense-log.md.
  2. Generate a profit-and-loss report.
  3. Update local financial state.
  4. Send a summary through the announcement destination specified by --to.

The combination of --announce and --to "[YOUR_TELEGRAM_CHAT_ID]" establishes an external transmission channel for derived financial information. This behavior conflicts with the privacy representation in SKILL.md that financial data remains local and is not transmitted externally.

The task runs in an isolated session, but isolation does not eliminate persistence or disclosure risk because the scheduled session is intentionally granted access to the financial files and an outbound messaging destination. Exploitation requires the us ...[truncated 1841 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove --announce and --to from the automated month-end example so scheduled processing remains local by default.
  2. Require explicit, informed user approval before each external transmission of financial information.
  3. Clearly disclose that openclaw cron add creates a persistent cross-session task and document how to inspect, disable, and remove it.
  4. Separate local report generation from external delivery. The scheduled task should create a local draft, while the user manually approves any subsequent send.
  5. If external delivery is retained as an optional feature:
    • Validate and display the destination before registration.
    • Require confirmation that the destination is private and controlled by the user.
    • Minimize transmitted content and omit transaction-level details.
    • Apply access controls and encryption supported by the messaging platform.
    • Record when and where summaries are sent.
    • Provide a local opt-out and task-removal command.
  6. Update the privacy documentation in SKILL.md so it accurately distinguishes local-only default behavior from optional external integrations.
  7. Avoid granting the scheduled session access to unrelated workspace files and restrict it to the minimum financial files required for report generation.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The instruction to trigger on inclusion in a weekly review prompt is ambiguous because it does not define when or how the agent should distinguish intentional financial review from ordinary planning or status-check language. That ambiguity can lead to overbroad activation, unintended processing of finance data, or silent coupling between unrelated agent tasks and sensitive bookkeeping operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The instruction to trigger on inclusion in a weekly review prompt is ambiguous because it does not define when or how the agent should distinguish intentional financial review from ordinary planning or status-check language. That ambiguity can lead to overbroad activation, unintended processing of finance data, or silent coupling between unrelated agent tasks and sensitive bookkeeping operations.

Content

No source excerpt is available for this finding.