ClawHub
Back to skill

Security audit

Tally Extractor

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed invoice-to-Tally bridge workflow, but it handles sensitive accounting data and can trigger downstream Tally entries.

Install only if you trust and control the configured bridge and messaging setup. Before using it with real invoices, verify who can access Telegram/WhatsApp messages, bridge logs, and Tally results, and consider requiring confirmation before entries are posted for high-value or sensitive documents.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The prompt tells users that an 'Entry posted to Tally' was performed by Instance A, while the declared architecture says this skill is extractor-only and forwards JSON to a bridge. This misrepresents system behavior, weakens operator understanding of trust boundaries, and can cause users to act on false assumptions about where accounting actions occurred and which component is responsible.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
These clarification templates state that after the user responds, Instance A will 'post to Tally,' even though direct posting is explicitly out of scope for this skill. In a financial workflow, that kind of role confusion is security-relevant because it obscures which service performs the privileged action and can mislead users during troubleshooting, auditing, or incident response.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The generic error text says something went wrong 'while posting to Tally,' which again inaccurately attributes a privileged operation to this extractor skill. Although this is primarily a messaging issue, inaccurate failure attribution can hinder diagnosis, conceal the real failing boundary, and cause unsafe operational decisions in a multi-component accounting pipeline.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The document explicitly instructs Instance A to forward clarification messages to the user on Telegram, but provides no privacy guidance, data-minimization rule, or warning about exposing invoice/accounting details through a third-party messaging channel. In this skill’s context, clarification prompts may include party names, voucher metadata, tax details, or other sensitive business information, so the omission can lead to unnecessary disclosure outside the primary processing boundary.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.