Security audit

Kiwi Receipts

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent tax-assistant purpose, but it needs review because it stores sensitive financial records and exports spreadsheets/CSV with concrete safety gaps.

Install only if you are comfortable keeping sensitive tax and business records in local plaintext files under ~/.openclaw/data/kiwi-receipts/. Review file permissions, keep backups, validate all tax outputs with an accountant before filing, and be cautious opening generated XLSX/CSV files until spreadsheet text sanitization is fixed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate_report.py:181
Finding: Spreadsheet Formula Injection in XLSX and CSV Exports
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:168
Finding: Sensitive Tax and Financial Records Stored Without Explicit Permission Controls
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:22
Finding: Unpinned Third-Party Package Installation Creates Supply-Chain Exposure
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger list includes very broad everyday terms like "tax," "income," "receipt," and "invoice," making accidental invocation likely in unrelated conversations. In this skill, accidental activation is more dangerous because it handles and stores highly sensitive financial and tax records, so a false trigger could cause unintended collection, persistence, or export of private data.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 93% confidence
Finding: The plan directs modification of SKILL.md, which is the skill's own instruction and behavior definition. Self-modification is dangerous because it allows an implementation workflow to alter future agent behavior, potentially expanding permissions, changing safeguards, or embedding unsafe instructions that persist after the current task.
Content: Scanner excerpt · docs/plans/2026-03-19-v2-full-tax-coverage.md (reported line 7)May include surrounding context.
md
**Goal:** Extend kiwi-receipts from GST-only to cover sales/income tracking, IR3 annual income tax, provisional tax, asset depreciation, and Xero CSV export — turning it into a near-complete personal tax assistant for NZ sole trader builders. **Architecture:** Add 3 new JSON data files (income.json, assets.json, tax-history.json) alongside existing receipts.json. Extend config.json with new fields. Add new reference docs for income tax, depreciation, and provisional tax. Extend generate_report.py with new sheet generators. Update SKILL.md with new commands and compliance rules. **Tech Stack:** Python 3 (openpyxl for XLSX, csv module for Xero export), JSON flat-file storage, OpenClaw SKILL.md format.

Self-Modification

High

Category: Rogue Agent
Confidence: 94% confidence
Finding: This task specifically instructs extending SKILL.md compliance rules, again modifying the governing behavior document rather than just application logic. In an adversarial or mistaken plan, such changes could silently weaken restrictions, alter disclosures, or normalize unsafe actions under the appearance of documentation work.
Content: Scanner excerpt · docs/plans/2026-03-19-v2-full-tax-coverage.md (reported line 1416)May include surrounding context.
md
--- ## Task 12: Update SKILL.md — Compliance Rules for Income Tax **Files:** - Modify: `SKILL.md` — extend Compliance Rules section

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill performs persistent local file writes and invokes external scripts, but it does not declare any explicit tool scope or allowed-tools restrictions. That increases the blast radius if the skill is invoked unexpectedly or interpreted by a permissive agent runtime, because sensitive tax data could be written, modified, or exported without a narrowly defined permission boundary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill stores business name, GST number, receipts, income, assets, and tax history on local disk, but it does not clearly warn users about that persistence in the user-facing description or setup flow. This is sensitive financial data, and absent disclosure undermines informed consent and may lead users to expose regulated or confidential business records without realizing they are retained locally.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The invocation condition "user asks about GST, income tax, or tax returns" is ambiguous and broad enough to match general informational tax questions that do not require this storage-capable skill. Because the skill can create files, append records, and generate exports, over-broad activation increases the chance of users being routed into stateful operations they did not intend.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The skill intentionally persists receipts and tax records across sessions in a fixed directory under the user's home folder. In context this is core functionality, but it still introduces real security and privacy risk because long-lived sensitive financial data accumulates on disk, potentially without encryption, retention controls, or easy user awareness.
Content: Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.
After confirmation, append to ~/.openclaw/data/kiwi-receipts/receipts.json:

bash
mkdir -p ~/.openclaw/data/kiwi-receipts

Read existing receipts.json (or start with []), append the new receipt with a generated UUID as id, and write back. Each receipt object:

Unbounded Output

Medium

Category: Output Handling
Confidence: 80% confidence
Finding: Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
Content: Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.
md
6. **Depreciation** -- Asset depreciation schedule (if assets.json has data) 7. **IR3 Annual Tax** -- Annual income tax summary (when period=all or period=annual) **GST101A auto-fill logic:** If income.json has data for the period, BOTH sides are auto-filled: - Box 5: Total sales and income (from income.json) -- AUTO-FILLED

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill exposes a destructive "delete last" command without a clear warning in the interface text that it permanently removes receipt records. Since the records are tax-relevant and intended for compliance use, accidental deletion could cause loss of audit evidence, incomplete returns, or inability to substantiate claims.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Multiple command definitions pair English commands with Chinese alternatives such as "收入", "资产", "预缴税", and "导出xero", but the plan does not explain language selection, opt-in, or locale behavior. Per policy, locale-specific behavior should either be optional or clearly documented as justified; here the mixed-language command design appears imposed without user choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The Xero export workflow handles detailed financial transaction data and directs sending a CSV to the user for import into a third-party platform, but omits any warning or consent checkpoint about external disclosure. In a tax assistant context, this can lead to inadvertent exposure of sensitive client, invoice, and expense information to third-party systems or wrong destinations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The plan explicitly instructs the implementing agent to push code to GitHub and publish to ClawHub, which grants deployment/distribution capability beyond the tax-processing purpose of the skill. Even if intended as normal release workflow, adding publish actions increases the blast radius of any mistaken or malicious changes by moving them from local edits into external systems.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The natural-language rule says records must be kept in English, which imposes a language constraint in the skill instructions. Because the file does not frame this as a documented compliance limitation of output behavior or offer user choice where possible, it may violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The instruction to use a separate execution superpower/sub-skill introduces unnecessary agent orchestration capability unrelated to tax calculations or receipt processing. Chaining to a more powerful executor can bypass intended scope limits and make downstream actions harder to audit or constrain.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The guide states that the skill auto-fills GST return boxes from receipts without an explicit warning that the user must review and validate the figures before filing. In a tax-preparation context, this can cause users to over-trust OCR/classification output and submit incorrect returns, leading to compliance errors, penalties, or misstated GST claims.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 63% confidence
Finding: This line states that records must be kept in English, which is a language constraint presented in natural language. Because SQP-3 covers language or locale policy violations, this should be clarified as an external statutory requirement to avoid appearing as an unjustified skill-level language restriction.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.