ClawHub
Back to skill

Security audit

Expense Snap

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local expense tracker, with expected local storage and CSV export behavior but some hardening gaps users should understand.

Install only if you are comfortable storing receipt and spending details in a local SQLite database inside the skill directory. Keep CSV exports in a location you choose, avoid overwriting important files, and treat exported CSVs as sensitive; be cautious opening exports in spreadsheet apps if receipt fields came from untrusted text or OCR.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/expense_snap.py:191
Finding

CSV Formula Injection in Expense Export

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill invokes a Python helper and writes persistent state to a SQLite database and CSV output, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens least-privilege controls and can let a host agent run shell/file-write capable behavior without clear policy review, which is especially relevant because user-influenced receipt data may be passed into command execution paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill persists expense information, including merchant, payment method, notes, and image path, to a local database via sqlite3.connect and subsequent inserts. The code does not provide a confirmation prompt, user-facing warning, or explanatory comment/docstring near this persistence behavior, even though it stores potentially sensitive financial data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest describes capturing receipt details, categorizing spending, and generating monthly reports from a local SQLite ledger. In addition to those functions, the record command also creates and updates a separate budgets table via --budget inputs, which is a broader finance-management capability not mentioned in the manifest description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The export-csv command writes potentially sensitive receipt data to any attacker-controlled filesystem path supplied via --output. In an agent setting, this can enable unintended data exfiltration or overwriting of user files outside the skill’s runtime area, especially because the manifest description does not clearly disclose arbitrary file export behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The export path is fully user-controlled and the code creates parent directories and writes receipt contents without constraining the destination. In agentic or semi-trusted environments, this increases the risk of silently placing sensitive financial data in unexpected locations or clobbering existing files.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · test_expense_snap.py (reported line 19)May include surrounding context.

python
self.temp_dir.cleanup()

    def run_cli(self, *args):
        result = subprocess.run(
            [sys.executable, str(self.base_dir / "scripts" / "expense_snap.py"), *self.base_arg, *args],
            capture_output=True,
            text=True,

Static analysis

No suspicious patterns detected.