SMB Invoice Tracker

• Outcome: Review
• Latest audit: Jun 30, 2026 · 8:02 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches an invoice-tracking purpose, but it appears to record reminders and Gmail authorization states in ways that could mislead a business user.

Review this skill carefully before installing. It may be useful for local invoice tracking, but do not rely on its reminder status as proof that an email or message was actually sent unless you verify delivery yourself. Avoid using LLM reminder generation for sensitive invoices unless you are comfortable sending payer names, amounts, due dates, and notes to MiniMax, and periodically review or delete the stored ledger files if they contain customer or business-sensitive data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The command is named and presented as sending a reminder, but it only prints generated text while recording the reminder as sent in persistent storage. This can create a false audit trail and cause operators to believe customer communications occurred when they did not, potentially leading to missed collections, disputes, or inaccurate business records.

Intent-Code Divergence

Low

• Confidence: 90% confidence
• Finding: The simulated Gmail authorization flow can set gmail_authorized=true in local config without performing any OAuth verification. This creates a false trust state that downstream features may interpret as authorization, weakening control-flow checks and increasing the chance of unsafe assumptions or misuse once real integrations are added.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Invoice details including payer identity, amounts, due dates, and notes are sent to an external LLM service without an explicit user-facing consent step at the time of transmission. In the finance context this may disclose sensitive business or personal data to a third party and violate user expectations, privacy requirements, or contractual constraints.

Session Persistence

Medium

• Category: Rogue Agent

Content

author: "NASSER AL-SOLAITTI"
description: "Local invoice tracking ledger with optional LLM-generated reminder text. Add invoices manually, track outstanding/paid status, generate cash flow reports. Use when user says 'track an invoice', 'add an invoice', 'show my outstanding invoices', or 'invoice report'.
permissions:
  - filesystem-write: write invoice and config data to ~/.openclaw/smb-invoice-tracker/
  - env: read MINIMAX_API_KEY from environment (for optional LLM reminder generation)
  - network: send invoice fields (payer name, amount, due date, note) to minimax LLM API when reminder generation is used
privacy: |

• Confidence: 88% confidence
• Finding: The skill explicitly persists invoice and configuration data under ~/.openclaw/smb-invoice-tracker/, creating ongoing storage of potentially sensitive business and customer information. Even though persistence is central to the skill's function and appears benign, local session/data persistence increases exposure if the host is shared, backed up insecurely, or if other components can read the stored files.

Static analysis

No suspicious patterns detected.