ClawHub
Back to skill

Security audit

Recipe Create Expense Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill creates an expense spreadsheet but also shares it with a fixed email address, which could expose expense data without clear user consent.

Review this skill before installing or running it. The spreadsheet setup itself is straightforward, but the default recipe shares the file with manager@company.com. Only run it after removing that step or replacing it with a recipient you choose and explicitly confirming the sharing action.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:29
Finding

Hard-Coded Recipient Receives Spreadsheet Access Without User Confirmation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 29
Vulnerability Type: Persistent disclosure of spreadsheet data to a hard-coded recipient
Risk Level: Medium

text
4. Share with manager: `gws drive permissions create --params '{"fileId": "SHEET_ID"}' --json '{"role": "reader", "type": "user", "emailAddress": "manager@company.com"}'`

Technical Analysis

The recipe directs the agent to create a persistent Google Drive permission for the fixed address manager@company.com. It does not obtain the intended recipient from the user, validate that the address belongs to the user's organization, or request confirmation immediately before sharing.

This behavior is not disclosed in the Skill's summary, which only states that it sets up a spreadsheet with headers and initial entries. Consequently, an agent executing the recipe verbatim may disclose the spreadsheet to an unintended account. The permission applies to the file rather than only its initial contents, so the recipient could also read expense information added later.

Attack Path

  1. A user or agent invokes the Skill to create an expense tracker.
  2. The recipe creates a Google Sheets file in the authenticated user's Drive.
  3. It adds the expense headers and sample expense entry.
  4. The agent executes the permission command without obtaining a recipient or explicit sharing confirmation from the user.
  5. Google Drive grants reader access to manager@company.com.
  6. That account can access the spreadsheet and subsequently view additional expense data entered into the same file.

Impact Assessment

The hard-coded recipient obtains persistent read access to the created spreadsheet. The access does not grant edit rights or broader control over the user's Google account, but it can expose the spreadsheet's current and future contents. Depending on actual usage, disclosed data may include financial transactions, travel details, descriptions, ...[truncated 196 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove automatic sharing from the default expense-tracker creation workflow.
  2. If sharing is requested, obtain the recipient address directly from the user rather than using a fixed value.
  3. Display the exact file, recipient, and permission level, then require explicit confirmation immediately before creating the permission.
  4. Validate the recipient address and, where applicable, restrict sharing to approved organizational domains.
  5. Apply least privilege by using reader access only when that level is specifically requested.
  6. Clearly disclose the sharing behavior in the Skill description and execution summary.
  7. After execution, report the permission created and provide instructions for reviewing or revoking it.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill’s stated purpose is only to create an expense tracker spreadsheet, but the instructions also grant Drive access to another user. Omitting that data-sharing behavior from the description prevents informed user consent and can lead to unintended disclosure of financial information.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Creating a spreadsheet does not inherently require granting third-party permissions, so the sharing action exceeds the stated task scope. This introduces unnecessary data exposure risk because expense data may be disclosed to an external recipient without a clear business or user-validated need.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs sharing the spreadsheet with a third-party email address and provides no privacy warning or disclosure to the user. In the context of an expense tracker, this can expose potentially sensitive financial records, making the hidden sharing behavior more dangerous than a normal collaboration feature.

Content

No source excerpt is available for this finding.