Security audit

Cn Expense Tracker

Security checks for vulnerabilities and agentic risk

Overview

This is a local Chinese expense tracker with some ordinary data-loss and CSV-export risks, but no hidden network behavior or unrelated privileged actions were found.

Install only if you are comfortable storing personal expense data as local JSON files under ~/.qclaw/workspace. Treat deletes as permanent, and be careful opening exported CSV files in spreadsheet software if any record text starts with =, +, -, or @. The promotional links in the documentation are not needed for local bookkeeping.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/expense.py:270
Finding: CSV Formula Injection in Exported Expense Records
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill describes file read/write behavior by storing data in a local JSON file, but it does not declare any explicit tool scope or permissions. This creates a transparency and least-privilege problem: users and hosting systems cannot clearly evaluate or constrain the file access the skill expects, increasing the chance of overbroad filesystem access or unsafe execution assumptions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation exposes a delete command without warning that it permanently removes stored expense records or may be irreversible. In a personal finance context, accidental deletion can cause real data loss and undermine record integrity, especially if users assume there is undo, confirmation, or backup support.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The top-level description and examples present the tool exclusively as a Chinese-language personal expense assistant, and the interactive interface and categories are likewise designed only for Chinese input. For an all-file-types language policy check, this is a natural-language locale constraint without user opt-in or a documented region-specific justification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest repeatedly describes the skill as '本地记账，无账户、无云端' and '无需联网', framing it as a local personal-finance tool. However, the same skill file promotes an external website and a free online diagnosis link, which introduces behavior/capability outside the stated bookkeeping purpose and contradicts the local-only framing at the skill description level.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: A personal expense tracker is expected to support recording, summarizing, budgeting, and exporting expenses. The appended branding and external '免费检测你的品牌在AI搜索中有没有存在感' link are unrelated to expense tracking and introduce a marketing capability that is not justified by the manifest's stated purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.