Money Crisis Ladder

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:41 AM UTC
• Version: 1.0.0

Overview

The skill is coherent financial-crisis guidance, but it asks to persist sensitive financial details and run reminders without clear consent, retention, or deletion controls.

Review this skill before installing. It may be useful for financial-crisis planning, but users should only enable persistent state and reminders if the host platform provides clear consent, per-user isolation, deletion controls, and protection for sensitive financial data. Prefer a pinned, verified install command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:451
• Finding: Persistent Storage of Sensitive Financial Information Without Defined Protections## Vulnerability Details **File Location**: `SKILL.md:451-488` **Vulnerability Type**: Persistent plaintext sensitive-data storage **Risk Level**: Medium ### Vulnerable Code ```yaml ## Agent State Persist across sessions: money_crisis: phase: null safety_check_done: false phase_1: tier_1_covered: false snap_applied: false creditors_called: [] assistance_applied: [] phase_2: monthly_income: null monthly_minimum_expenses: null runway_months: null bills_negotiated: [] expense_cuts_made: [] phase_3: monthly_essentials: null targets: one_month: null three_months: null six_months: null current_balance: null automatic_transfer: amount: null day: null set_up: false milestones: first_100: false one_month: false three_months: false emergency_definition: [] subscriptions_cancelled: [] flags: income_gap: false debt_counselor_referred: false unbanked: false ``` ### Technical Analysis The Skill explicitly directs the Agent to persist detailed financial information across sessions. The proposed state includes monthly income, minimum expenses, financial runway, savings balances, transfer amounts and dates, creditor interactions, assistance applications, and indicators of financial hardship. The Skill does not define explicit user consent, data minimization, encryption, access controls, retention periods, purpose limitations, or deletion procedures. Consequently, an implementation that follows these instructions literally may retain sensitive financial information in an inadequately protected state backend. This is classified as `T09: Insecure Skill Coding Practices` because the unsafe configuration may expose sensitive information through insufficient storage and lifecycle controls. The state is user-supplied data rather than atta ...[truncated 1527 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit, informed user consent before enabling cross-session financial state. 2. Default to session-only processing and make persistence optional. 3. Minimize retained data: - Store progress indicators instead of exact balances or income. - Avoid retaining automatic-transfer dates and amounts. - Avoid retaining creditor and assistance-application details unless strictly necessary. 4. Encrypt retained information at rest and in transit using platform-managed keys. 5. Apply per-user and per-agent access controls with strict tenant isolation. 6. Define short retention periods and automatically delete stale financial records. 7. Provide user-visible controls to inspect, export, correct, and delete stored state. 8. Prevent sensitive state from appearing in logs, telemetry, crash reports, or reminder text. 9. Document the purpose and lifetime of every retained field. 10. Add a declaration such as: ```yaml persistence: enabled: false requires_explicit_consent: true sensitive_fields: - monthly_income - monthly_minimum_expenses - current_balance - automatic_transfer retention_days: 30 user_deletable: true encryption_required: true ```

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15
• Finding: Unpinned Package Execution Through npx Installation Command## Vulnerability Details **File Location**: `SKILL.md:15` **Vulnerability Type**: Unpinned executable dependency and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```yaml install: "npx clawhub install money-crisis-ladder" ``` ### Technical Analysis The installation metadata instructs users or automation to execute `clawhub` through `npx` without specifying a package version, integrity digest, lockfile, or verified source. If the package is unavailable locally, `npx` may retrieve executable package content from the configured npm registry. Because package resolution is mutable, the code executed at installation time may differ from the code reviewed during this audit. Compromise of the package publisher, registry account, dependency chain, or package distribution channel could therefore convert the documented installation command into a remote code-execution path. No evidence establishes that the current `clawhub` package is malicious. The vulnerability is the unsafe trust and version-resolution model rather than a confirmed malicious dependency. ### Attack Path 1. An attacker compromises the package publisher, registry account, release process, or an indirectly loaded package. 2. The attacker publishes a malicious version that can be selected by the unpinned `npx clawhub` reference. 3. A user or installation service executes the documented installation command. 4. `npx` resolves and downloads the mutable package release. 5. Package startup logic, lifecycle scripts, or invoked CLI code executes with the privileges of the installing process. 6. The malicious package can access resources available to that process, potentially including project files, environment variables, credentials, network access, and user-writable configuration. Exploitation requires compromise or malicious replacement of the package or its dependency chain; such a compromise was not observed in the audited project. ### Impac ...[truncated 554 chars]
• Remediation: ## Remediation Suggestions 1. Pin `clawhub` to a reviewed, immutable version: ```yaml install: "npx --yes clawhub@<reviewed-version> install money-crisis-ladder" ``` 2. Prefer installation through a lockfile-backed workflow with verified integrity hashes. 3. Document the expected registry and verified package publisher. 4. Disable or audit dependency lifecycle scripts where the installation workflow permits. 5. Execute installation in a sandbox or minimally privileged environment without production credentials. 6. Verify package signatures or provenance attestations before execution. 7. Re-review the dependency and its transitive dependency tree before updating the pinned version. 8. Consider distributing a verified installer binary or using an internal allowlisted package mirror.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

- Food and medication FIRST, always
- Never recommend payday loans, title loans, or high-interest debt
- If someone mentions financial abuse or feeling unsafe, redirect to safe-exit-planner
- Never moralize about financial situations — austerity is a response to circumstances, not a character flaw
- Medical debt and credit card debt collectors are not the priority — housing and food are
- If income is genuinely below survival cost, say so — budgeting harder will not fix a structural gap

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The manifest description says to use the skill when someone faces "any financial emergency" and spans situations from immediate rent crises to general rebuilding after income loss. That scope is broad and lacks exclusion conditions or concrete trigger phrases, which could cause the skill to activate during ordinary money discussions rather than only acute crisis scenarios.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The usage bullets include common situations like "Living paycheck to paycheck" and "wants a concrete system," which can overlap with everyday financial coaching rather than crisis intervention. Because the file does not pair these with explicit non-matches or escalation criteria, the activation boundary remains ambiguous.

Static analysis

No suspicious patterns detected.