Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent and locally scoped, but it directs automatic changes to financial records without explicit confirmation.
Install only if you want an agent to maintain local expense records for you. Before use, set a clear preference that file writes, deletions, migrations, recategorization, statement imports, and shared contact/account updates require a preview and your approval.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
One file per month at ~/Clawic/data/expenses/ledger/<YYYY-MM>.md, created with the first entry of that month. Append-only: corrections are new rows referencing the original, never edits that erase history.
# Ledger — 2026-07
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
| Nickname | Type | Institution | Last four | Currency | Used for | Access reference |
|---|---|---|---|---|---|---|
| amex personal | credit card | Amex | 1234 | EUR | daily spend | keychain:amex-personal |
```markdown
The skill explicitly instructs the agent to write and update multiple user data files automatically ('Write on the way out') whenever certain budgeting events occur, but it does not require explicit confirmation before modifying files. In an agent setting, this can cause unintended state changes, silent corruption of financial records, or user surprise, especially because the files are authoritative records used by other skills.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
The most-changed rules in the whole subject, and the ones most often quoted from a stale memory.
- **Client entertainment** is fully non-deductible in some jurisdictions, partially deductible in others; the treatment has changed repeatedly in the last decade in several countries.
- **Business meals** are commonly deductible at a reduced percentage, and that percentage has moved more than once. Never state a figure without checking the current year.
- **Staff events** often have their own separate allowance with a per-head annual cap.
- **Gifts** typically have a low per-recipient annual cap and frequently require the business name to be on the item.
- **Subsistence while travelling** on business is usually treated more favourably than a local meal.
The file directs immediate writes into local ledger files at session start and during normal operation without a user-facing warning that persistent local data will be modified. In an agent setting, silent persistence is risky because the user may believe they are only asking for advice or drafting, while the skill is already changing financial records on disk.
The instruction to never ask clarifying questions before writing and to record entries even when important fields are missing means ambiguous or incomplete financial data can be permanently stored without the user's informed approval. This is especially dangerous in an expense ledger because incorrect dates, vendors, categories, or payment methods can corrupt later reconciliation and reporting while appearing authoritative once written.
This guidance expands the skill from simple user-reported expense capture into reading broader financial records such as card and bank statements. That increases data exposure and may cause the skill to access sensitive financial information the user did not intend to provide in the current interaction, which is a real scope-expansion and privacy risk even if the goal is legitimate reconciliation.
The skill instructs writes to shared memory/configuration artifacts like vendor rules and due-tracking state, not just the monthly expense ledger. Cross-file mutation can create persistent side effects outside the immediate task, poison future categorization behavior, and alter state relied on by other finance workflows without clear user awareness.
The skill instructs adding, correcting, and deleting ledger data based on reconciliation outcomes without a prominent explicit warning or confirmation step before persistent modification. In financial records, silent destructive changes can cause data loss, auditability problems, and incorrect balances, especially when matching heuristics or account assumptions are wrong.
The manifest frames this skill around recording, splitting, categorizing, reporting, and reconciling expenses. Line L77 instructs updating ~/Clawic/data/finances/accounts.md for card reissue metadata, which is broader account-management behavior in a separate finances namespace rather than direct expense-log reconciliation.
This section directs in-place writes across multiple persistent finance files (ledger, memory, accounts, config) during a single pass, but does not require a clear warning, preview, or transactional safeguards. If the agent misclassifies entries or partially fails, it could leave the user with inconsistent financial state spread across several files.
Suspicious Unicode normalization or mixed-script content
The skill instructs the agent to write to several persistent files (memory.md, group files, contacts.md, config.yaml, and artifacts/) as part of normal operation, but it does not include an explicit user-facing warning or confirmation step before modifying durable data. In an agent setting, this can cause unintended or overbroad state changes from ambiguous user requests, corrupting records or persisting sensitive financial/contact data without sufficiently clear consent.
The skill directs the agent to write trip data, participant records, due items, and summaries into multiple persistent files without any explicit safety check, confirmation step, or warning about modifying user data. In an agent setting, that creates a real risk of silent state changes from ambiguous prompts, mistaken trip matching, or over-eager automation.
This instruction expands the skill's write scope beyond the trip expense envelope into multiple other user files and folders, including contacts, due-tracking structures, and artifacts. Even if operationally useful, cross-file writes increase the chance of unintended data modification, corruption, or privacy exposure when the user only asked to log an expense or inspect a budget.
This markdown file instructs users that personal receipts can be discarded and to purge receipts on a schedule. While the section discusses retention policy, it does not explicitly warn that this results in deletion of stored records or caution users to verify retention/legal requirements before purging beyond the surrounding general guidance.
Lines L43-L46 prescribe storing per-bank CSV column mappings and tracking imported ranges over time. While helpful operationally, this is a persistent tooling/configuration capability beyond the manifest's user-facing purpose of logging and reconciling expenses, and it is not explicitly declared in the manifest.
The skill explicitly instructs the agent to update several user files (claims/<year>.md, ledger data, artifacts/, ## Due, and config.yaml) in the same turn, but it does not require a clear user-facing confirmation before those writes occur. This creates a real integrity risk: an agent could modify multiple records based on an incomplete or mistaken interpretation of the user's request, and the changes may be hard for the user to notice or unwind.
The skill instructs reading and relying on shared bookings records outside the primary expenses area, which broadens data access and couples this skill to another datastore. In context this is likely intended to avoid duplicate entries, but it still weakens isolation and can expose or misuse travel booking data unrelated to the immediate expense task.
No suspicious patterns detected.