ClawHub
Back to skill

Security audit

Invoice & Expense Categoriser (HMRC)

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only bookkeeping helper for categorising UK expenses, with no executable code, credential requests, or hidden data movement.

Safe to install from a security perspective. Treat outputs as bookkeeping guidance, not professional tax advice; avoid pasting unnecessary personal identifiers, full account numbers, card details, or customer data, and verify complex or borderline tax treatment with an accountant before filing.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Common Categorisation Rules

Apply these rules automatically. Do not ask the user — just categorise correctly and note it:

### Never Deductible (Disallowed)
- **Client meals and entertaining** — sole traders cannot deduct business entertainment
Confidence
83% confidence
Finding
The instruction to 'apply these rules automatically' and 'do not ask the user' encourages autonomous classification of financially and legally sensitive transactions without obtaining needed context. In a tax/bookkeeping skill, this can cause incorrect treatment of mixed-use, deductible, or disallowed items, leading to inaccurate filings, compliance errors, or user overreliance on the model's judgment.

Static analysis

No suspicious patterns detected.