ClawHub
Back to skill

Security audit

InvoiceTW

Security checks across malware telemetry and agentic risk

Overview

This skill needs review because it presents hard-coded demo invoice-prize results as real Taiwan invoice checks.

Install only if you treat it as a local receipt tracker or demo. Do not rely on its prize-checking results unless it is changed to use an official Taiwan Ministry of Finance source, and remember that entered receipt details are stored locally in plain JSON files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The skill persistently stores receipt metadata locally without clearly informing the user, creating privacy risk because invoices may reveal spending habits, dates, merchants, and potentially sensitive personal information. In this context the risk is elevated because the tool is explicitly for long-term receipt tracking and writes into a predictable directory under the user's home path, increasing the chance of unintended retention or local disclosure.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly states that receipt records, win history, and reports are stored under the user's local workspace, but it does not clearly warn users before collection or persistence of potentially sensitive financial metadata. Receipt numbers, merchants, dates, categories, and amounts can reveal spending habits and personal activity, so silent local retention creates a privacy and data-handling risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.