ClawHub
Back to skill

Security audit

乖猫记账

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned for BillCat bookkeeping, but it can create and delete financial records remotely and lacks strong safeguards around deletion.

Install only if you trust BillCat and are comfortable sending bill descriptions, date ranges, and your BillCat API key to billcat.cn. Treat delete operations carefully: the skill can delete one or multiple bill records by ID without asking for a second confirmation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)

Tainted flow: 'request' from os.environ.get (line 70, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/billcat_api.py (reported line 82)May include surrounding context.

python
)

    try:
        with urllib.request.urlopen(request, timeout=timeout) as response:
            raw_body = response.read().decode("utf-8", errors="replace")
    except urllib.error.HTTPError as exc:
        error_body = exc.read().decode("utf-8", errors="replace")

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

代码文件 scripts/extract_bill.py 只调用了 EXTRACT_BILL_URL 对文本进行 post_json 请求，核心行为是提取并保存账单信息。其余逻辑仅是命令行参数处理以及将 API 返回结果渲染为 JSON/Markdown。声明中提到的按 billId 删除账单、按时间范围统计收入支出、查看账本与资产汇总等能力，在该代码片段中均未出现对应 API 调用或实现。因此，声明覆盖的能力明显多于实际代码行为，描述与代码存在实质性不匹配。

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/billcat_api.py (reported line 47)May include surrounding context.

python
if key:
        return key

    env_path = pathlib.Path.home() / ".openclaw" / ".env"
    if env_path.exists():
        try:
            txt = env_path.read_text(encoding="utf-8", errors="ignore")

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/billcat_api.py (reported line 66)May include surrounding context.

python
if key:
        return key

    env_path = pathlib.Path.home() / ".openclaw" / ".env"
    if env_path.exists():
        try:
            txt = env_path.read_text(encoding="utf-8", errors="ignore")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill declares capabilities that require environment access, file reads, and network calls, but it does not define any explicit tool scope or allowed-tools boundaries. This weakens least-privilege guarantees and can lead to unintended access or execution in hosts that rely on manifest-level permission declarations for policy enforcement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description says the skill is suitable when converting '一句中文消费/收入描述' into a structured bill, which constrains usage to Chinese-language input. This is a natural-language locale restriction, but the file does not present it as an explicit user opt-in choice or justify the limitation as a documented region-specific requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation exposes a destructive delete operation without requiring or recommending a confirmation step, preview, or recovery guidance. In an agent context, this increases the chance of accidental or prompt-induced deletion of financial records, especially when bill IDs are copied from prior outputs and deletion is irreversible or hard to audit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The markdown formatter emits fixed Chinese labels such as 响应码, 结果, 开始日期, and 附加字段, which enforces a specific language in user-visible output. The policy requires avoiding forced language/locale behavior unless the skill offers a choice or clearly documents a justified locale constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This code reads the BILLCAT_API_KEY from environment variables, a local JSON config, and a ~/.openclaw/.env file, which is sensitive credential access. There is no confirmation prompt, logging/print statement, or comment/docstring disclosing that the skill will inspect these locations for credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The function sends JSON payload data to an external BillCat API endpoint and includes the user's API key in the Authorization header. While the missing-key error mentions how to obtain the key, the code provides no user-facing warning, prompt, or inline documentation that local data in the payload will be transmitted to a remote service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The function performs a delete action against the BillCat API by sending "action": "delete", which is a destructive operation affecting user data. The file contains no confirmation prompt, warning message, or explanatory comment/docstring disclosing that running this script will delete bills before the request is made.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script sends user-provided bill text directly to an external BillCat API, which can expose potentially sensitive financial and personal information such as spending details, merchants, and timestamps. In this skill’s context, external transmission is expected for the feature to work, but the lack of a user-facing warning, consent notice, or privacy disclosure still creates a genuine data privacy risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script renders user-facing output with fixed Chinese strings such as '无', '名称', '资产类型', and '附加字段' without offering any locale or language selection. This creates a language-policy issue because the skill imposes a specific language on all users rather than allowing choice or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This code performs an HTTP/API request via post_json that transmits user-supplied billing date parameters to an external skill API, but there is no confirmation prompt, logging, print statement, or explanatory comment/docstring disclosing that data is being sent. For a code file, outbound transmission of user or system data should have some visible disclosure unless clearly communicated elsewhere.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The error message instructs the user to get the API key from the app using only the Chinese name '乖猫记账', which assumes a specific language/locale. There is no accompanying language choice or bilingual wording for users who may not read Chinese.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The markdown formatter emits fixed Chinese labels such as 响应码, 结果, and 删除账单ID with no option to select language or locale. This hardcoded language choice can violate language/locale policy where tools must not force a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The generated markdown output uses Chinese-only labels such as 原始文本, 响应码, and AI 回复, which imposes a specific language on all users. The file does not offer a language option or document that this skill is intentionally limited to a Chinese-language context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code sends a JSON payload, including user-provided start and end dates, to a remote API via post_json. The script includes no confirmation prompt, print/log notice, or inline warning explaining that input data will be transmitted over the network.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.