Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward local expense tracker, but users should understand it stores sensitive spending records locally and can export them to CSV.
Install only if you are comfortable storing expense details in local Clawd memory. Avoid entering information you would not want retained, and treat any CSV exports as sensitive files that may need secure storage or deletion.
The trigger "log expense" overlaps with the built-in command namespace around "log," creating a shadowing risk where user intent may be misrouted between core functionality and the skill. In practice, this can cause accidental invocation, confusion, or unintended handling of sensitive finance-related input by the wrong component.
The trigger phrase "track spending" is broad enough to match ordinary budgeting or finance questions that may not be intended to invoke this specific skill. In a skill that persists financial data, accidental activation can cause unintended recording, querying, or exposure of sensitive spending information.
The phrase "what did I spend" is ambiguous and resembles a normal user question rather than an intentional skill invocation. Because the skill handles persistent financial records, ambiguous triggering increases the risk of accidental access to sensitive summaries or unintended data operations.
The skill mentions that expense data persists in local memory but does not clearly warn users up front that sensitive financial information will be stored. Users may disclose transactions, merchants, and budgeting details without informed consent, creating privacy and retention risks on shared or compromised machines.
Advertising CSV export without warning that financial records will be written to disk can lead users to create unprotected files containing sensitive spending history. Such files may be accessible to other local users, backups, sync services, or malware, increasing confidentiality risk beyond in-memory storage.
No suspicious patterns detected.
