ClawHub
Back to skill

Security audit

Bookkeeping Basics

Security checks for vulnerabilities and agentic risk

Overview

This is a plain educational bookkeeping guide with no executable code, persistence, credential use, or hidden behavior, though users should treat its tax guidance as U.S.-specific and not professional advice.

Install only if you want a general bookkeeping checklist for a small solo business. Treat tax, deduction, and receipt-retention statements as U.S.-oriented educational guidance and confirm current rules with a CPA or local tax professional before relying on them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
96% confidence
Finding
The trigger list is broad and contains common finance/accounting terms like 'accounting', 'receipts', and 'profit and loss', which can cause the skill to activate outside narrow bookkeeping contexts. Over-broad activation increases the chance of irrelevant or lower-quality financial guidance being surfaced in contexts where a more appropriate skill or locale-specific advice should apply.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The skill presents IRS rules and U.S. tax treatment as general guidance without gating for jurisdiction or offering a locale choice. In a bookkeeping/tax-adjacent skill, this can mislead non-U.S. users into following incorrect recordkeeping or deduction rules, creating compliance and financial risk.

Static analysis

No suspicious patterns detected.