Spend Ledger

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.insecure_tls_verification

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI05: Unexpected Code Execution

What this means

If an agent passes an attacker-controlled filter value to query-log.sh, arbitrary Node.js code could run on the user's machine with the skill's local privileges.

Why it was flagged

User-controlled CLI filter values are interpolated directly into a Node.js -e JavaScript program. A crafted service, date, skill, or summary value containing quotes and JavaScript can break out of the string literal and execute code.

Skill content

--service) SERVICE="$2"; shift 2 ;; ... if ('${SERVICE}') filters.service = '${SERVICE}';

Recommendation

Pass filters through process.argv, stdin JSON, or environment variables and parse them as data; validate date and enum fields, and never template untrusted strings into executable code.

ConcernHigh Confidence

ASI09: Human-Agent Trust Exploitation

What this means

A user may install the skill believing it only sees outputs, while it can inspect payment inputs and may persist fragments of sensitive arguments locally.

Why it was flagged

This privacy claim is broader than the provided implementation: plugin.js reads tool params before execution, and detectors.js stores truncated argument summaries. Users could underestimate what payment-call data is visible to the skill.

Skill content

No wallet keys or credentials are accessed — the skill observes tool call results only

Recommendation

Revise the documentation to clearly state that tool names, parameters, and results are inspected; add explicit redaction for credential-like fields before storing argument summaries.

NoteHigh Confidence

ASI06: Memory and Context Poisoning

What this means

The local ledger can contain financial history, service details, transaction identifiers, user-request context, and portions of payment tool arguments.

Why it was flagged

Detected payment records persist a truncated copy of payment tool arguments. This is local and aligned with transaction review, but payment arguments can include sensitive context or token-like fragments.

Skill content

tool_args_summary: truncate(argsStr, 200)

Recommendation

Treat the data directory as sensitive, avoid placing secrets in payment arguments, and add field-level redaction for tokens, API keys, card/payment-method fields, and wallet secrets.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

A bad or compromised pattern feed could cause false payment detections or affect duplicate-payment blocking behavior.

Why it was flagged

The skill automatically fetches and caches remote community patterns that influence what tool calls are treated as payments. This is disclosed and configurable, but it makes remote pattern provenance important.

Skill content

const PATTERNS_URL = process.env.SPEND_LEDGER_PATTERNS_URL || `${API_BASE}/patterns.json`; ... writeFileSync(CACHE_PATH, JSON.stringify(data), { mode: 0o600 });

Recommendation

Disable community syncing for sensitive environments, and prefer signed/versioned pattern lists with clear review and rollback controls.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Legitimate repeated payments with identical inputs in the same session may be blocked, and false positives in detection could interrupt expected work.

Why it was flagged

The plugin can block tool calls before execution when it believes a duplicate payment is being attempted. This is central to the stated purpose and disclosed, but it is a high-impact control over payment-capable tools.

Skill content

if (duplicate) { return { block: true, blockReason: `Duplicate payment blocked — identical payment to ...` }; }

Recommendation

Provide a clear user-visible override or confirmation path for legitimate repeats, and ensure duplicate checks include enough scope, such as tool name, recipient, amount, and session.

Findings (4)

critical

suspicious.dangerous_exec

Location: test/test.js:368
Finding: Shell command execution detected (child_process).

critical

suspicious.env_credential_access

Location: server/patterns-sync.js:23
Finding: Environment variable access combined with network send.

critical

suspicious.env_credential_access

Location: test/test.js:371
Finding: Environment variable access combined with network send.

warn

suspicious.insecure_tls_verification

Location: scripts/query-log.sh:26
Finding: HTTPS certificate verification is disabled.