Clawshier

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:25 AM UTC
• Version: 0.1.5

Overview

The skill mostly does what it advertises, but it should be reviewed because it can automatically delete a Google Sheets tab and may write receipt text in a way Sheets can treat as formulas.

Install only with a dedicated empty spreadsheet shared solely with a least-privilege service account. Be aware that receipt images and extracted text go to OpenAI by default unless local Ollama is forced, and avoid processing receipts from untrusted sources until formula neutralization or RAW sheet writes are added. Back up any spreadsheet before first use because Sheet1 may be deleted automatically.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: lib/googleSheets.js:207

Finding

Spreadsheet Formula Injection Through Untrusted Receipt Fields

Content

View full analysis

[ expense.fingerprint, item.description, item.quantity || 1, item.amount, ]); await appendRows(spreadsheetId, BREAKDOWN_SHEET, itemRows); ``` ### Technical Analysis Receipt images and their OCR output are untrusted input. Fields such as `expense.vendor`, `expense.category`, and `item.description` originate from OCR and LLM processing, but neither stage constitutes an input-validation security boundary. The application writes these values using Google Sheets' `USER_ENTERED` mode. In this mode, strings beginning with formula indicators such as `=`, `+`, `-`, or `@` can be interpreted as spreadsheet expressions rather than literal text. No validation or formula neutralization is performed before the values reach `appendRow` or `appendRows`. An attacker can therefore place formula-like text in a submitted receipt and attempt to have it selected as the vendor or an item description. The resulting expression may manipulate displayed spreadsheet content, reference other ce ...[truncated 1752 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (39)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 46)May include surrounding context.

git clone https://github.com/fdocr/clawshier.git cd clawshier npm install cp .env.example .env # then fill in your keys

text

## Configuration

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This skill explicitly instructs deletion of the default 'Sheet1' tab if present, which is a destructive side effect not emphasized in the high-level description. Unexpected deletion in a spreadsheet-integrated skill can cause data loss or violate user expectations, especially if the spreadsheet is reused for other purposes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This skill explicitly instructs deletion of the default 'Sheet1' tab if present, which is a destructive side effect not emphasized in the high-level description. Unexpected deletion in a spreadsheet-integrated skill can cause data loss or violate user expectations, especially if the spreadsheet is reused for other purposes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This skill explicitly instructs deletion of the default 'Sheet1' tab if present, which is a destructive side effect not emphasized in the high-level description. Unexpected deletion in a spreadsheet-integrated skill can cause data loss or violate user expectations, especially if the spreadsheet is reused for other purposes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This skill explicitly instructs deletion of the default 'Sheet1' tab if present, which is a destructive side effect not emphasized in the high-level description. Unexpected deletion in a spreadsheet-integrated skill can cause data loss or violate user expectations, especially if the spreadsheet is reused for other purposes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This skill explicitly instructs deletion of the default 'Sheet1' tab if present, which is a destructive side effect not emphasized in the high-level description. Unexpected deletion in a spreadsheet-integrated skill can cause data loss or violate user expectations, especially if the spreadsheet is reused for other purposes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This skill explicitly instructs deletion of the default 'Sheet1' tab if present, which is a destructive side effect not emphasized in the high-level description. Unexpected deletion in a spreadsheet-integrated skill can cause data loss or violate user expectations, especially if the spreadsheet is reused for other purposes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This skill explicitly instructs deletion of the default 'Sheet1' tab if present, which is a destructive side effect not emphasized in the high-level description. Unexpected deletion in a spreadsheet-integrated skill can cause data loss or violate user expectations, especially if the spreadsheet is reused for other purposes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This skill explicitly instructs deletion of the default 'Sheet1' tab if present, which is a destructive side effect not emphasized in the high-level description. Unexpected deletion in a spreadsheet-integrated skill can cause data loss or violate user expectations, especially if the spreadsheet is reused for other purposes.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The lockfile includes form-data 4.0.5, which is flagged for CRLF injection in multipart construction. In a skill that processes receipt/invoice images and likely uploads files or metadata to external APIs, malformed or attacker-controlled multipart field names could enable request manipulation against downstream services if untrusted values are passed into multipart fields.

Content

No source excerpt is available for this finding.

Possible Typosquatting: 'gaxios' resembles popular package 'axios'

High

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run_pipeline.js (reported line 2)May include surrounding context.

js

#!/usr/bin/env node
require("dotenv").config({ path: require("path").resolve(__dirname, "../../.env") });

const fs = require("fs");
const path = require("path");

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/expense_store_sheets/handler.js (reported line 2)May include surrounding context.

js

#!/usr/bin/env node
require("dotenv").config({ path: require("path").resolve(__dirname, "../../.env") });

const fs = require("fs");
const path = require("path");

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/expense_structurer/handler.js (reported line 2)May include surrounding context.

js

#!/usr/bin/env node
require("dotenv").config({ path: require("path").resolve(__dirname, "../../.env") });

const fs = require("fs");
const path = require("path");

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/expense_validator/handler.js (reported line 2)May include surrounding context.

js

#!/usr/bin/env node
require("dotenv").config({ path: require("path").resolve(__dirname, "../../.env") });

const fs = require("fs");
const path = require("path");

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/receipt_ocr/handler.js (reported line 2)May include surrounding context.

js

#!/usr/bin/env node
require("dotenv").config({ path: require("path").resolve(__dirname, "../../.env") });

const fs = require("fs");
const path = require("path");

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README advertises logging extracted expense data to Google Sheets but does not clearly warn that financial information will be stored in a cloud-hosted spreadsheet. This can expose business or personal financial records to unintended sharing, retention, or compliance issues if users assume processing is local or temporary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README states that OCR uses OpenAI by default, which means receipt or invoice images may be transmitted to a third-party cloud provider. Because receipts often contain sensitive financial and personal data, failing to clearly disclose this default data flow creates a real privacy and compliance risk for users.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 86)May include surrounding context.

md

## Google Sheets setup

1. Create a Google Cloud service account and download the JSON key file
   - Go to [Service Accounts](https://console.cloud.google.com/iam-admin/serviceaccounts) in the Google Cloud Console
   - Click **Create Service Account**, give it a name, and click through to finish
   - On the service account's **Keys** tab, click **Add Key > Create new key > JSON** and save the downloaded file

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill invokes a Node.js pipeline and relies on environment-provided credentials and external services, but it does not declare tool scope such as allowed tools, network access, or env access. That weakens platform-level containment and reviewability, making it easier for a skill with code execution and credential use to operate with broader-than-expected privileges.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file exposes a destructive capability that can delete an entire sheet tab via the Google Sheets API. For an expense-logging skill, this exceeds the minimally necessary append/update behavior and increases risk of accidental or induced data loss if another part of the skill invokes it with attacker-controlled or mistaken input.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Sheet deletion occurs with no confirmation, warning, or soft-delete behavior in this code path. That makes accidental invocation or misuse materially dangerous because it can immediately remove user data from a spreadsheet without an opportunity to review or recover before the API call executes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code writes JSON to a path supplied via --output-file and creates parent directories as needed, which can modify the filesystem outside the current working context. There is no confirmation prompt, log/print statement, or inline comment/docstring warning users that invoking this helper may create directories and overwrite files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

At L24, the pipeline invokes processExpenseStore(step3), which appears to persist expense data. This file provides no confirmation prompt, logging, comment, or docstring warning that user data will be stored, so the storage action is not disclosed here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code sends receipt or invoice images to external processing endpoints: OpenAI over the network, and optionally an Ollama server specified by configuration. Receipt images commonly contain sensitive personal and financial data, and this file provides no consent check, privacy warning, destination validation, or minimization before transmission, so users may unknowingly disclose sensitive data to third parties or to a non-local Ollama host.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: lib/visionOcr.js:81

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: test/pipeline-smoke.test.js:20

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: lib/visionOcr.js:182