ClawHub
Back to skill

Security audit

Audit Financial Data Extraction

Security checks for vulnerabilities and agentic risk

Overview

This skill is a focused financial-data extraction helper that reads a user-provided audit-report text file and writes a local Excel result file, with no hidden network, credential, or destructive behavior found.

Before installing, understand that automatic mode writes extracted audit-report financial values to a local Excel file. Choose an appropriate output location, avoid storing confidential reports in shared folders, review the extracted results for accuracy, and delete or protect generated files according to your organization's data-handling rules.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly instructs users to run an automatic extraction workflow that writes an Excel file derived from audit-report text, but it does not clearly warn that local files will be created and may contain sensitive financial data. This is a genuine safety/transparency issue because users may unknowingly persist confidential information to disk, increasing the risk of unintended disclosure, mishandling, or upload to other systems.

Static analysis

No suspicious patterns detected.