Expenses

• Outcome: Pass
• Latest audit: Jul 27, 2026 · 8:49 AM UTC
• Version: 1.0.2

Overview

This expense-tracking skill keeps local financial notes and shared contact/finance references, with the sensitive behavior disclosed and aligned to its stated purpose.

Install only if you want an agent to maintain local expense records for you. Expect it to read and modify files under Clawic expenses, finances, and contacts folders, including bank-statement-derived entries, shared split participants, budget targets, accounts, recurring-charge rows, and reports. Do not paste full credentials or card details; the skill says to strip secrets, but you should still review sensitive inputs and any announced file changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The template explicitly authorizes writes to a shared contacts store for people the user splits with, which expands the skill from expense logging into modifying cross-skill personal contact data. Because this is a shared box used by other skills, incorrect or unnecessary writes can propagate beyond the expenses domain and create privacy and integrity issues.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill description says it is not for subscription inventories, but the template instructs the agent to write recurring charges into a shared subscriptions file. That scope mismatch can cause the agent to silently manage unrelated financial records in a shared location, affecting other finance workflows and violating least privilege.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The template includes household or personal budget target management in a shared budget file even though the manifest excludes zero-based budgeting. This broadens authority into planning/budget governance, letting an expense-logging skill alter durable budgeting records that may drive decisions in other tools.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The write rules direct the agent to record newly discovered recurring charges in the shared subscriptions inventory despite the stated exclusion of subscription management. This creates an unauthorized path for persistent cross-domain data modification from routine expense parsing, increasing the chance of silent scope creep and incorrect inventory state.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The shared finances section defines active maintenance of budget records, including identity rules and in-place updates, which operationalizes budgeting behavior outside the declared skill scope. Because these are shared finance files, erroneous updates can affect multiple skills and user decisions, not just this expense log.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to create and update user files automatically ('Write on the way out') whenever certain budget events occur, without requiring a clear confirmation step at the time of modification. In an agent setting, this can cause unintended persistence, silent modification of financial records, and user-data integrity issues if the agent misclassifies a conversation as a budget action or writes incomplete/incorrect values.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly instructs the agent to write entries directly into a local ledger file in the same turn, but it does not require an explicit confirmation or warning that local data will be modified. In an agent setting, this can cause unintended file changes, incorrect financial records, or silent corruption of user data if the parsed expense details are wrong.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The backfilling procedure directs the agent to access card and bank statements, which are highly sensitive financial records, without an explicit privacy notice, scope limitation, or confirmation step. Even if the intent is legitimate expense reconstruction, this increases the risk of over-collection, unnecessary exposure of unrelated transactions, and user surprise about sensitive data access.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The template says 'No permission needed' for writes and allows deletions within configured paths, but does not pair that autonomy with a prominent user-facing warning or confirmation model for destructive changes. In a financial-records skill, silent autonomous modification increases the risk of accidental corruption, privacy issues, and surprising side effects across shared files.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The split procedure instructs the agent to move data and delete the original section/file copy in the same turn, emphasizing that a copy must never remain, but it lacks safeguards against irreversible mistakes. In a memory-management context, this can destroy or orphan user financial records if the move is incorrect, partial, or triggered at the wrong threshold.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs the agent to modify several user files (`ledger/<YYYY-MM>.md`, `memory.md`, `accounts.md`, `config.yaml`) during reconciliation, but it does not require an explicit confirmation or warning before making potentially destructive financial data changes. In a finance workflow, silent writes can cause loss of auditability, accidental overwrites, or incorrect account metadata changes that are hard for the user to detect and reverse.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The skill instructs the agent to write updates to several local data files (`claims/<year>.md`, `artifacts/`, `## Due`, and `config.yaml`) in the same turn without any explicit requirement to notify the user or obtain confirmation before persisting changes. In an agent setting, silent file modification can cause unintended data corruption, overwrite user-maintained records, or create auditability problems even if the content itself is non-executable and finance-related.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs the agent to write updates into user data files and artifacts as part of normal operation, but it does not require confirmation, preview, backup, or other safeguards before modifying persistent records. In a financial logging skill, unintended or over-broad writes can silently corrupt expense history, due dates, monthly totals, or tax-report artifacts, which can mislead later decisions and be difficult to detect.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill explicitly instructs the agent to write trip, participant, contact, due-date, and artifact data across multiple personal records in the same turn, but provides no guardrail to confirm consent or warn the user that persistent files will be modified. In a personal-finance context, this increases the risk of silent over-collection, unintended persistence of third-party personal data, and corruption or proliferation of sensitive records if the agent misidentifies the trip or participants.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.