ClawHub
Back to skill

Security audit

Intelligent Budget Tracker

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed budget-tracking skill that handles sensitive financial data but does not show hidden, destructive, or unrelated behavior in the reviewed artifacts.

Install only if you trust the npm package and SkillBoss with the financial details used for parsing and insights. Keep the API key in a protected environment variable, choose a private storage path, protect backups and exports, and have the agent ask before adding transactions or processing recurring entries.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation explicitly shows financial spending data being sent to a third-party API for natural-language parsing and insights, but it does not provide a clear privacy warning, consent requirement, or data-handling disclosure. Because the data includes sensitive personal financial information, users and downstream agents may unknowingly transmit private records off-device.

Missing User Warnings

Low
Confidence
81% confidence
Finding
The skill stores financial records on local disk in platform-specific paths, but the documentation does not clearly warn that sensitive budget, income, and expense data will persist unencrypted on the host. In agent environments or shared systems, this can expose private financial records to other users, backups, logs, or later compromise.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.