Cn Expense Tracker

• Outcome: Pass
• Latest audit: Jun 7, 2026 at 2:33 AM UTC
• Version:
  1.2.6

Overview

This is a straightforward local expense-tracking skill with disclosed local storage and no evidence of network access, hidden behavior, or broad system changes.

Reasonable to install if you want a local Chinese expense tracker. Before using deletion, export or back up ~/.qclaw/workspace/expenses.json, and be aware that budgets are also stored locally in ~/.qclaw/workspace/budget.json and exports are written to ~/.qclaw/workspace/expenses_export.csv.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill documents file read/write behavior by storing records in a local JSON file, but it does not declare any permissions for those capabilities. Undeclared filesystem access weakens transparency and consent, making it harder for users or platforms to assess what the skill can modify or persist.

Missing User Warnings

Medium

• Confidence: 75% confidence
• Finding: The documentation includes a delete command for records without warning about irreversibility, confirmation, backup, or recovery options. In a personal finance tool, silent or poorly explained deletion can lead to permanent loss of financial history and user harm, especially if invoked accidentally or by another agent on the user's behalf.

VirusTotal

65/65 vendors flagged this skill as clean.