ClawHub
Back to skill

Security audit

Tally Extractor

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for invoice extraction and Tally posting, but it can trigger real accounting changes and send sensitive invoice data to a bridge without an explicit approval step for each posting.

Review this skill before installation if you use it with live books. It is designed to send invoice contents and tax identifiers to a configured bridge and can cause Tally vouchers, and possibly ledgers, to be created through Instance B. Install it only when the bridge endpoint and operators are trusted, credentials are protected and rotated, and your workflow requires explicit human approval before posting accounting entries.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly instructs forwarding invoice data, GSTINs, and related financial details to an external bridge service, but it does not require a clear user-facing disclosure or consent step before transmitting that sensitive data off-platform. In a Telegram/WhatsApp workflow, users may reasonably assume the document is only being processed locally by the bot, so silent onward transfer increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This skill contains direct instructions to POST extracted invoice JSON to an external endpoint using bearer authentication and HMAC, which confirms intentional exfiltration of sensitive business data outside the chat platform. While the transmission is part of the intended architecture and includes authentication controls, it still expands the trust boundary and can expose invoices, GSTINs, and financial records if the bridge endpoint, tunnel, or receiving environment is misconfigured or compromised.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

md
BODY='{"schema_version":"1.0",...}'
SIGNATURE=$(echo -n "$BODY" | openssl dgst -sha256 -hmac "$BRIDGE_HMAC_SECRET" | cut -d' ' -f2)

curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $BRIDGE_BEARER" \
  -H "X-Signature: hmac-sha256=$SIGNATURE" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference/bridge.md (reported line 167)May include surrounding context.

md
BODY=$(cat payload.json)
SIG=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$BRIDGE_HMAC_SECRET" -binary | xxd -p -c 256)

curl -s -X POST "$BRIDGE_URL/v1/post-voucher" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $BRIDGE_BEARER" \
  -H "X-Signature: hmac-sha256=$SIG" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

These templates discuss entry creation and even mention 'New ledger(s) created' without an explicit warning that the workflow can create accounting records and possibly new masters. In an accounting context, silent or weakly disclosed record creation is risky because users may not realize a conversational action can alter books, increasing the chance of accidental postings or unauthorized master creation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The success template tells the user 'Entry posted to Tally' even though the documented role of Instance A is only extraction and forwarding to a bridge. This misrepresents which component performed the accounting action, which can mislead users during failures, incident response, or reconciliation and reduce accountability for a sensitive financial operation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The clarification template says the system needs details 'before posting this to Tally,' implying Instance A is the posting agent. In a financial workflow, that ambiguity can cause users to trust the wrong system, provide sensitive corrections to the wrong stage, and misunderstand where validation and approval happen.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The low-confidence template says 'before I post to Tally,' again blurring the distinction between extraction and posting. Because this skill handles invoice data and may influence accounting entries, inaccurate authority claims can undermine informed user approval and complicate troubleshooting when an incorrect entry appears.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The generic error message says something went wrong 'while posting to Tally,' which attributes the failure to this skill's operation rather than the downstream bridge/service that actually posts. That creates operational security risk by obscuring fault domains, delaying root-cause analysis, and confusing users about where to verify or retry a sensitive accounting action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill documentation states that POST /v1/generate-pdf generates a PDF and returns a server-side file_path, which implies a file write on Instance B. In markdown files, safety-relevant behavior affecting user data or system state should be disclosed, but this section provides no explicit warning about file creation, storage location, or retention.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The instruction says the instance speaks in "accountant-friendly English" and the tone rules require Indian currency and date formatting. This is a natural-language locale constraint presented as mandatory behavior, with no indication that the user can choose another language or locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.