ClawHub
Back to skill

Security audit

Personal Expense Tracker

Security checks across malware telemetry and agentic risk

Overview

This expense tracker mostly does what it claims, but it silently writes a second copy of monthly spending summaries into the skill’s own folder.

Install only if you are comfortable with local storage of personal expense data. Before use, remove or change the stats-command write to data/sample.json, or treat the skill directory as containing sensitive financial summaries as well as the main ~/.expense-tracker data file.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises executable usage that invokes a local Python script capable of reading and writing expense data, but the skill metadata does not declare any corresponding permissions or storage behavior. This creates a transparency and trust problem: users and hosting platforms cannot accurately assess what local data the skill may access or modify, which can lead to unintended file access or persistence.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The stats command writes a secondary JSON file containing user expense summaries to a repository-relative path outside the declared primary datastore. This creates an unexpected data sink that can expose potentially sensitive spending information to other tools, users, version control, backups, or packaging workflows without the user's knowledge.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
Writing user-derived data into the repository tree is not required for a personal expense tracker and broadens where sensitive data may persist. In environments where the repo is shared, synced, committed, or inspected by other automation, this can leak monthly totals and category breakdowns beyond the intended local private store.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The monthly stats command silently persists a summary of the user's expenses to a sample file without any user-facing warning or consent. Silent secondary storage is dangerous because users reasonably expect a read/reporting action to display statistics only, not to create new copies of sensitive financial data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.