Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a real Organizze finance API integration, but it can directly change or delete sensitive financial records without built-in confirmation safeguards.
Install only if you intend to let the agent access your Organizze account. Treat all create, update, and delete commands as live financial changes: verify IDs with list/get first, ask the agent to summarize planned changes, and require explicit approval before any mutation or deletion.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
cp .env.example .env
Edit .env with your credentials:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if (!email || !token || !userAgent) {
throw new Error(
'Missing required environment variables: ORGANIZZE_EMAIL, ORGANIZZE_TOKEN, ORGANIZZE_USER_AGENT\n' +
'Copy .env.example to .env and fill in your credentials.'
);
}
The skill documents destructive delete operations against personal finance resources without requiring confirmation, backup guidance, or a visible warning about irreversible effects. In this context, accidental deletion can remove transactions, accounts, or categories and corrupt a user's financial records or reporting.
The instruction to 'Run any script' combined with available create, update, and delete operations grants broad, unsafeguarded access to scripts that modify sensitive financial data. Because this skill is specifically for a live personal finance API, unrestricted execution materially increases the chance of unintended writes, deletions, or high-impact misuse if invoked with malformed or adversarial input.
Common actions: `list`, `get <id>`, `create <json>`, `update <id> <json>`, `delete <id>`
Run any script without arguments to see its full usage.
## Key conventions
The publish instructions invoke npx clawhub without pinning a specific package version. This allows whatever version is current in the registry at execution time to run, creating a supply-chain risk if a malicious or breaking release is published or if dependency resolution is tampered with.
This example again tells users to execute npx clawhub without a pinned version, so the command may fetch and run unreviewed code from the package registry. In a publishing workflow, that code typically has access to project files, environment variables, and registry credentials, increasing supply-chain exposure.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
This markdown file includes multiple delete command examples for accounts, categories, transactions, credit cards, and transfers, but it does not warn users that these actions may permanently remove financial data or alter related records. Under the markdown-specific warning criteria, destructive behaviors that can affect user data should be disclosed clearly.
The skill performs sensitive operations using environment credentials and remote API access, but it does not declare any explicit tool scope or allowed-tools boundary. In an agent environment, this can allow broader-than-expected execution against finance data, making accidental or unauthorized data access or modification more likely.
The activation text is broad enough to match many generic finance, budgeting, expense, and transfer requests, which can cause the skill to trigger in contexts beyond clear user intent. Because this skill has write/delete capabilities against a personal finance API, overbroad routing increases the chance of unintended access, data exposure, or destructive actions.
The documentation exposes create, update, and delete operations for accounts, categories, transactions, credit cards, and transfers without requiring an explicit confirmation step before destructive or irreversible actions. In a personal-finance context, accidental deletion or modification can corrupt records, alter balances, and cause significant user harm.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import { getCredentials } from './credentials.js';
const BASE_URL = 'https://api.organizze.com.br/rest/v2';
function buildHeaders() {
const { email, token, userAgent } = getCredentials();
This function builds Basic Authorization headers from credentials and sends them over network requests, which transmits sensitive account data to an external API. In this file there is no confirmation prompt, logging, comment, or docstring disclosing that authenticated outbound requests will be made.
The deleteAccount function performs a destructive DELETE request, and the CLI maps the 'delete' action directly to it without any confirmation prompt or warning. Aside from a usage string, there is no user disclosure in this file that the operation is irreversible or destructive.
This module issues multiple client.get/post/put/del calls for credit card, invoice, and payment endpoints, which likely involve sensitive financial information. The file contains no docstrings, comments, or runtime notices informing users that these operations send financial data to a remote service.
The file provides create, update, and delete actions for credit cards, but the CLI path only documents usage and executes the action directly. There is no confirmation prompt, warning message, or explanatory comment/docstring alerting the user that sensitive financial records will be created, changed, or removed.
The file defines a transaction deletion call and exposes it through the CLI, but there is no confirmation prompt or explicit warning at the point of execution. Because deletion is safety-relevant and potentially irreversible, the code should disclose that action more clearly before proceeding.
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"transfers": "node src/routes/transfers.js"
},
"dependencies": {
"dotenv": "^16.4.7"
}
}