ClawHub
Back to skill

Security audit

Financy

Security checks across malware telemetry and agentic risk

Overview

This finance API skill is coherent, but it needs Review because it can access, export, modify, and delete personal financial records without clear authentication or safety controls.

Review before installing or using with real financial data. Only use it if you trust the ToolWeb/Financy service and can verify authentication, per-user authorization, protected short-lived export links, and clear confirmation before creating, updating, deleting, or exporting transactions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill documents a destructive DELETE transaction endpoint but provides no warning about irreversibility, confirmation requirements, or safeguards against accidental deletion. In a personal finance context, deletion of financial records can cause loss of audit history, budgeting errors, and user harm if an agent invokes the endpoint too casually.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The export endpoint handles sensitive personal financial records but the documentation omits privacy and data-handling warnings about where exported data is stored, how long it persists, and who can access the download URL. This increases the risk of exposing transaction history, spending patterns, and other sensitive financial information through agent misuse or careless sharing.

External Transmission

Medium
Category
Data Exfiltration
Content
"success": true,
  "export_id": "exp_12345",
  "format": "csv",
  "download_url": "https://api.toolweb.in/tools/financy/exports/exp_12345.csv",
  "record_count": 42,
  "generated_at": "2024-01-15T10:30:00Z"
}
Confidence
84% confidence
Finding
https://api.toolweb.in/

Tool Parameter Abuse

High
Category
Tool Misuse
Content
---

### DELETE /api/financy/transaction/{transaction_id}
**Delete Transaction**

Removes a specific transaction from the user's account.
Confidence
93% confidence
Finding
DELETE /api/financy/transaction/{transaction_id}

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.