ClawHub
Back to skill

Security audit

Intelligent Budget Tracker

Security checks for vulnerabilities and agentic risk

Overview

This budget-tracker skill is mostly coherent, but it sends potentially detailed financial records to a third-party AI API and installs mutable external code without enough scoping or privacy controls.

Review this carefully before installing. Use it only if you are comfortable sharing budget and transaction details with SkillBoss API for AI features, and prefer a pinned, reviewed package version with clear privacy terms, redaction, and local-only options before entering sensitive financial records.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:150
Finding

Unnecessary Disclosure of Sensitive Financial Data to a Third-Party API

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned External Packages Prevent Verification of Installed Behavior

Content
View full analysis
More info: https://skillboss.co/skills/intelligent-budget-tracker ``` ### Technical Analysis The installation instructions retrieve mutable external artifacts without specifying an exact version, integrity hash, immutable commit, or reviewed package archive. Package managers may therefore resolve different content at different times. The audited project contains only `README.md` and `SKILL.md`; it does not contain the implementation of `agent-money-tracker` or other executable source code. Consequently, the behavior of the package installed by these commands cannot be verified from the reviewed artifact. This creates a supply-chain trust boundary. If a registry account, package publication process, package manager source, or upstream package is compromised, users may receive code that was not represented during this audit. Depending on package-manager behavior, malicious code could potentially execute through installation lifecycle scripts or later when the package is imported. The audit found no evidence that either named package is currently malicious. The finding concerns the lack of reproducibility and integrity controls, not a confirmed malicious payload. ### Attack Path 1. A user follows the documented `npm install` or `clawhub install` command. 2. The package manager resolves the current artifact associated with the unpinned package name. 3. An upstream publisher, compromised publisher account, registry compromise, or later package release introduces unsafe code. 4. The user receives that chang ...[truncated 1017 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill advertises natural-language expense parsing and AI insights, but the description does not clearly warn that user financial/spending data will be transmitted to an external third-party API. Because the data involved is sensitive financial metadata, lack of explicit disclosure and consent can lead to unintended privacy exposure and policy/compliance issues.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The hardcoded external API domain indicates dependency on a remote service for analysis of financial records. Even if intended functionality, transmitting money-tracker data off-device expands the trust boundary and creates privacy, compliance, and breach exposure if the service, logs, or downstream processors are compromised.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md
const SKILLBOSS_API_KEY = process.env.SKILLBOSS_API_KEY;

async function generateInsightsFromData(spendingData: object): Promise<string[]> {
  const response = await fetch('https://api.skillboss.com/v1/pilot', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${SKILLBOSS_API_KEY}`,

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The hardcoded external API domain indicates dependency on a remote service for analysis of financial records. Even if intended functionality, transmitting money-tracker data off-device expands the trust boundary and creates privacy, compliance, and breach exposure if the service, logs, or downstream processors are compromised.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md
const SKILLBOSS_API_KEY = process.env.SKILLBOSS_API_KEY;

async function generateInsightsFromData(spendingData: object): Promise<string[]> {
  const response = await fetch('https://api.skillboss.com/v1/pilot', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${SKILLBOSS_API_KEY}`,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation describes local storage, export, and backup features for financial records without clearly warning that these files may contain sensitive income, expense, merchant, and savings data. Users or downstream agents may store or export this data insecurely, increasing risk of accidental disclosure or theft.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

md
| Variable | Description |
|----------|-------------|
| `SKILLBOSS_API_KEY` | SkillBoss API Hub key，用于自然语言解析和 AI 智能洞察（`https://api.skillboss.com/v1/pilot`） |
| `CLAWHUB_DATA_PATH` | 可选，自定义数据存储路径 |

---

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file is primarily written in English, but this heading switches to Chinese and later environment-variable descriptions also include Chinese text. This imposes mixed-language documentation without user opt-in or justification, which can violate language/locale consistency expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The environment-variable table is mainly English, but the description text includes Chinese phrases. Because no multilingual option or locale note is provided, this is a natural-language policy inconsistency in the skill documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.