ClawHub
Back to skill

Security audit

OPC Cashflow Manager

Security checks for vulnerabilities and agentic risk

Overview

This cash-flow skill handles sensitive local business data, but its reads, writes, invoice import, and forecasting behavior match its stated purpose and are disclosed.

Install only the reviewed opc-cashflow-manager files from a pinned commit or release, and be aware that the skill reads and stores local cash-flow snapshots plus optional invoice records. Before using invoice import or forecast archive features, confirm the directories involved and treat the generated snapshots as sensitive financial records.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:51
Finding

Unpinned Skill Installation from a Mutable Remote Repository

Content
View full analysis

Vulnerability Details

File Location: README.md, line 51
Vulnerability Type: Unpinned third-party Skill supply chain
Risk Level: Medium

bash
git clone https://github.com/LeonFJR/opc-skills.git ~/.claude/skills/opc-skills

Technical Analysis

The documented installation command clones the current default branch of a remote repository without pinning it to a reviewed commit or signed release and without performing an integrity check. The command also installs the complete Skill suite into the Agent's Skill directory rather than limiting installation to this audited Skill.

Consequently, the content installed by this command can differ from the content reviewed during this audit. If the repository, its maintainer account, or its release process is compromised, an attacker could add malicious Skill instructions or executable scripts to the default branch. Placing such content in ~/.claude/skills/ may cause it to be loaded or invoked in later Agent sessions.

The reviewed project itself contains no malicious runtime code, remote payload execution, credential collection, persistence mechanism, or privilege-escalation behavior. The risk arises specifically from the mutable and unverified installation source documented in the README.

Attack Path

  1. An attacker compromises the remote repository, a maintainer account, or another component of its publishing process.
  2. The attacker modifies the repository's default branch to include hostile Skill instructions or executable scripts.
  3. A user follows the documented git clone command.
  4. The command installs the attacker's modified repository, including potentially unrelated Skills, into ~/.claude/skills/opc-skills.
  5. The Agent subsequently loads or invokes the malicious Skill content.
  6. The malicious content can influence Agent behavior or execute code with the permissions of the user running the Agent, subject to the Agent's tool and sandbox restr ...[truncated 700 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin installation instructions to a specific, reviewed commit hash or immutable release artifact rather than the mutable default branch.
  2. Publish a SHA-256 checksum or cryptographic signature for each release and require users to verify it before installation.
  3. Provide an installation procedure that copies only opc-cashflow-manager instead of cloning the entire Skill suite into the Agent's Skill directory.
  4. Use signed Git tags or release attestations and document how users can verify the maintainer signature.
  5. Review installed Skill files before enabling them, particularly instruction files and executable content under scripts/.
  6. Perform updates explicitly and pin each update to a newly reviewed version rather than automatically tracking the remote default branch.

A hardened installation flow should resemble:

bash
git clone https://github.com/LeonFJR/opc-skills.git /tmp/opc-skills
cd /tmp/opc-skills
git checkout --detach <reviewed-commit-hash>
# Verify the published checksum or signature here.
cp -r opc-cashflow-manager ~/.claude/skills/opc-cashflow-manager

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README includes very broad, natural-language example prompts such as 'How long can I survive at current burn rate?' and 'What's my cash position?'. In agent environments where skills may be matched from ordinary user phrasing, these generic examples can increase the chance of unintended invocation and cause sensitive financial data to be routed into this skill when the user did not explicitly intend to use it.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill clearly instructs file reads and writes (read_file(...), loading snapshots, and saving snapshot.json) but does not declare any explicit tool scope or allowed-tools boundary. That creates an authorization ambiguity where an agent may access or persist financial data beyond what the user reasonably expects, especially in environments that rely on manifest-declared permissions for least privilege.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The core philosophy is stated as a hard instruction using Chinese text mixed with English, but the skill does not offer a language preference or opt-in anywhere in the document. This can violate language/locale policy expectations because it imposes a specific language choice in normal operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

These instructions describe reading local financial snapshots and schemas automatically, which can expose sensitive cash-flow data without explicit user awareness at the time of access. In a financial skill, silent reads are more sensitive because the data includes bank-adjacent balances, invoices, commitments, and forecasts that users may not expect to be pulled implicitly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The cross-skill auto-import pulls invoice records from another skill's dataset, expanding access across trust boundaries without an explicit warning or consent step. Because invoice records contain sensitive client and receivables information, automatic correlation into cash-flow forecasts increases privacy and data-minimization risk if the user did not intend linked records to be accessed together.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Saving forecast snapshots to disk without a user warning creates persistence risk for sensitive financial data and may overwrite or accumulate records unexpectedly. In this skill's context, persisted monthly snapshots can reveal cash position, debts, receivables, and business health over time, so silent storage materially increases confidentiality and retention risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/forecasting-rules.md (reported line 18)May include surrounding context.

md
| Confidence | Probability Range | Default | Examples |
|------------|-------------------|---------|----------|
| **high** | 0.90 – 1.00 | 0.95 | Signed contract with payment terms, sent invoice (current), recurring client confirmed, deposit received |
| **medium** | 0.50 – 0.70 | 0.60 | Verbal agreement, proposal sent and acknowledged, likely renewal (no confirmation), milestone approaching |
| **low** | 0.10 – 0.30 | 0.20 | Pipeline lead, first contact / discovery call, speculative opportunity, referral not yet contacted |

**When no confidence is specified, default to medium (0.60).** Never assume high confidence without evidence.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This is a JSON manifest-like file, so SQP-1 applies. The description mentions invoices being 'auto-imported' from another manager, but the schema provides no explicit context, trigger conditions, or exclusions for when that import should happen, which makes the activation scope of this behavior underspecified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The closing note instructs that the conservative scenario should guide decisions, which imposes a specific decision-making policy in natural language. The file does not indicate that users can choose an alternative approach or opt into this preference.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.