ClawHub
Back to skill

Security audit

Invoices

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local invoice-archive workflow that stores accounting notes and documents on the user's machine, with no evidence of hidden code, exfiltration, or autonomous payment execution.

Install only if you want the agent to maintain a persistent local invoice archive and accounting memory under ~/Clawic/data/. Review generated filings, VAT summaries, supplier changes, and recurring due outputs before relying on them for tax, payment, or accountant-facing decisions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · approvals.md (reported line 59)May include surrounding context.

md
| Band | Requirement |
|---|---|
| Below threshold, known supplier, matches its history | Filed and scheduled; no approval event |
| Below threshold, new supplier | Supplier established first: identity, tax ID, bank details verified (`validation.md`) |
| Above threshold | Named approval recorded before payment, with the date |
| Well above threshold, or outside budget | Second approver, and the underlying commitment checked against the order or contract |

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill instructs the agent to recover missing invoice fields from external public registries and supplier websites. This expands the trust boundary beyond the user-provided document, creating a risk of ingesting incorrect or manipulated data and causing privacy, integrity, or filing errors without explicit user approval; in an agentic setting, it may also trigger unintended network access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill directs the agent to write supplier names, aliases, tax IDs, and parsing quirks into persistent memory files before finishing, without an explicit confirmation step. Persistent state modification based on a single document can poison future invoice processing, propagate OCR/extraction mistakes, and create unauthorized retention of sensitive business data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · memory-template.md (reported line 52)May include surrounding context.

md
Everything except the ledger, the archive, the shared boxes, and artifacts begins inside `memory.md`. Splitting is a procedure, not a suggestion:

1. Before appending to a section, count its entries.
2. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings, and comments do not count — then, in the same turn: create the new file in `~/Clawic/data/invoices/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file.
3. Keep the headings identical on both sides of the move, so the split is a copy-paste and never a rewrite.
4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest scopes this skill to receiving, filing, auditing, and retrieving invoices, plus VAT/export support around invoice records. These lines direct reconciliation of all business bank payments, including salaries, taxes, bank fees, FX differences, and transfers between own accounts, which is broader accounting/ledger-close activity rather than invoice handling.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest emphasizes invoice ingestion, checks, archive/search, VAT deduction support, and accountant exports for invoice data. These sections add autonomous recurring outputs, annual close packs, reconciliation summaries, due-date tracking, and filing-memory updates that amount to a broader accounting operations workflow than the manifest claims.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file says recurring outputs are 'driven by ## Due, so they happen without being requested,' which authorizes autonomous generation of summaries, VAT reports, and annual packs without explicit per-run user consent. In a finance context, that can cause unintended disclosure of sensitive business data, creation of authoritative-looking filings, or actions taken on stale assumptions, especially if outputs are shared or stored automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file explicitly instructs the agent to write persistent data to repository files (e.g. updating supplier aliases and open items) as part of a search workflow, but it does not require user confirmation or a warning before modifying records. In an archive/accounting context, silent writes can corrupt bookkeeping metadata, create audit-trail issues, or let a crafted query cause unauthorized state changes during what the user expected to be a read-only search.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
memory-template.md:68