Money Crisis Ladder

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:41 AM UTC
• Version: 1.0.0

Overview

The skill is coherent financial-crisis guidance, but it asks to persist sensitive financial details and run reminders without clear consent, retention, or deletion controls.

Review this skill before installing. It may be useful for financial-crisis planning, but users should only enable persistent state and reminders if the host platform provides clear consent, per-user isolation, deletion controls, and protection for sensitive financial data. Prefer a pinned, verified install command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:451

Finding

Persistent Storage of Sensitive Financial Information Without Defined Protections

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:451-488
Vulnerability Type: Persistent plaintext sensitive-data storage
Risk Level: Medium

Vulnerable Code

yaml

## Agent State

Persist across sessions:

money_crisis:
  phase: null
  safety_check_done: false
  phase_1:
    tier_1_covered: false
    snap_applied: false
    creditors_called: []
    assistance_applied: []
  phase_2:
    monthly_income: null
    monthly_minimum_expenses: null
    runway_months: null
    bills_negotiated: []
    expense_cuts_made: []
  phase_3:
    monthly_essentials: null
    targets:
      one_month: null
      three_months: null
      six_months: null
    current_balance: null
    automatic_transfer:
      amount: null
      day: null
      set_up: false
    milestones:
      first_100: false
      one_month: false
      three_months: false
    emergency_definition: []
    subscriptions_cancelled: []
    flags:
      income_gap: false
      debt_counselor_referred: false
      unbanked: false

Technical Analysis

The Skill explicitly directs the Agent to persist detailed financial information across sessions. The proposed state includes monthly income, minimum expenses, financial runway, savings balances, transfer amounts and dates, creditor interactions, assistance applications, and indicators of financial hardship.

The Skill does not define explicit user consent, data minimization, encryption, access controls, retention periods, purpose limitations, or deletion procedures. Consequently, an implementation that follows these instructions literally may retain sensitive financial information in an inadequately protected state backend.

This is classified as T09: Insecure Skill Coding Practices because the unsafe configuration may expose sensitive information through insufficient storage and lifecycle controls. The state is user-supplied data rather than atta ...[truncated 1527 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, informed user consent before enabling cross-session financial state.
2. Default to session-only processing and make persistence optional.
3. Minimize retained data:
   • Store progress indicators instead of exact balances or income.
   • Avoid retaining automatic-transfer dates and amounts.
   • Avoid retaining creditor and assistance-application details unless strictly necessary.
4. Encrypt retained information at rest and in transit using platform-managed keys.
5. Apply per-user and per-agent access controls with strict tenant isolation.
6. Define short retention periods and automatically delete stale financial records.
7. Provide user-visible controls to inspect, export, correct, and delete stored state.
8. Prevent sensitive state from appearing in logs, telemetry, crash reports, or reminder text.
9. Document the purpose and lifetime of every retained field.
10. Add a declaration such as:

yaml

persistence:
  enabled: false
  requires_explicit_consent: true
  sensitive_fields:
    - monthly_income
    - monthly_minimum_expenses
    - current_balance
    - automatic_transfer
  retention_days: 30
  user_deletable: true
  encryption_required: true

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Package Execution Through npx Installation Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15
Vulnerability Type: Unpinned executable dependency and supply-chain exposure
Risk Level: Medium

Vulnerable Code

yaml

install: "npx clawhub install money-crisis-ladder"

Technical Analysis

The installation metadata instructs users or automation to execute clawhub through npx without specifying a package version, integrity digest, lockfile, or verified source. If the package is unavailable locally, npx may retrieve executable package content from the configured npm registry.

Because package resolution is mutable, the code executed at installation time may differ from the code reviewed during this audit. Compromise of the package publisher, registry account, dependency chain, or package distribution channel could therefore convert the documented installation command into a remote code-execution path.

No evidence establishes that the current clawhub package is malicious. The vulnerability is the unsafe trust and version-resolution model rather than a confirmed malicious dependency.

Attack Path

1. An attacker compromises the package publisher, registry account, release process, or an indirectly loaded package.
2. The attacker publishes a malicious version that can be selected by the unpinned npx clawhub reference.
3. A user or installation service executes the documented installation command.
4. npx resolves and downloads the mutable package release.
5. Package startup logic, lifecycle scripts, or invoked CLI code executes with the privileges of the installing process.
6. The malicious package can access resources available to that process, potentially including project files, environment variables, credentials, network access, and user-writable configuration.

Exploitation requires compromise or malicious replacement of the package or its dependency chain; such a compromise was not observed in the audited project.

Impac

...[truncated 554 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin clawhub to a reviewed, immutable version:

yaml

install: "npx --yes clawhub@<reviewed-version> install money-crisis-ladder"

2. Prefer installation through a lockfile-backed workflow with verified integrity hashes.
3. Document the expected registry and verified package publisher.
4. Disable or audit dependency lifecycle scripts where the installation workflow permits.
5. Execute installation in a sandbox or minimally privileged environment without production credentials.
6. Verify package signatures or provenance attestations before execution.
7. Re-review the dependency and its transitive dependency tree before updating the pinned version.
8. Consider distributing a verified installer binary or using an internal allowlisted package mirror.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 438)May include surrounding context.

md

- Food and medication FIRST, always
- Never recommend payday loans, title loans, or high-interest debt
- If someone mentions financial abuse or feeling unsafe, redirect to safe-exit-planner
- Never moralize about financial situations — austerity is a response to circumstances, not a character flaw
- Medical debt and credit card debt collectors are not the priority — housing and food are
- If income is genuinely below survival cost, say so — budgeting harder will not fix a structural gap

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description says to use the skill when someone faces "any financial emergency" and spans situations from immediate rent crises to general rebuilding after income loss. That scope is broad and lacks exclusion conditions or concrete trigger phrases, which could cause the skill to activate during ordinary money discussions rather than only acute crisis scenarios.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The usage bullets include common situations like "Living paycheck to paycheck" and "wants a concrete system," which can overlap with everyday financial coaching rather than crisis intervention. Because the file does not pair these with explicit non-matches or escalation criteria, the activation boundary remains ambiguous.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.