ClawHub
Back to skill

Security audit

Income Tracker

Security checks for vulnerabilities and agentic risk

Overview

This income-tracking skill is mostly purpose-aligned, but it handles sensitive financial records with weak storage/export protections and uses insecure dependency download URLs.

Review this before installing if you will store real income data. Use a private DATA_PATH, verify file permissions, avoid opening exported CSVs containing untrusted notes or sources, and prefer a regenerated HTTPS lockfile with unnecessary dependencies removed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
package-lock.json:23
Finding

Dependencies Retrieved from an Insecure HTTP Registry Mirror

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
index.js:390
Finding

Spreadsheet Formula Injection and Invalid CSV Escaping

Content
View full analysis
`${r.date},${r.amount},${r.currency},${r.source},"${r.note}"` ).join('\n'); ``` ### Technical Analysis CSV output is constructed through direct string interpolation. Record fields such as `source` and `note` originate from caller-controlled income-record parameters and are not safely encoded before export. The implementation has two related weaknesses: 1. Values beginning with spreadsheet formula indicators such as `=`, `+`, `-`, or `@` are not neutralized. Spreadsheet applications may interpret such values as formulas even when the CSV field is enclosed in quotes. 2. Embedded double quotes, commas, carriage returns, and newlines are not consistently escaped. In particular, `note` is surrounded by quotes but internal quotes are not doubled. Other fields are not quoted at all. An attacker can therefore alter row or column boundaries and place a formula at the beginning of a newly injected cell. A malicious value could include a spreadsheet formula that triggers an external request or abuses a dangerous spreadsheet feature. The exact effect depends on the spreadsheet product, its version, security settings, and whether the user approves any warning prompts. ### Attack Path 1. An attacker or untrusted integration submits an income record containing a crafted `source` or `note`. 2. The `add` action stores that value in the local income-tracker JSON file. 3. A user invokes the `export` action with `format: "csv"`. 4. The application inserts the crafted field directly into the CSV response. 5. The user saves and opens the CSV in spreadsheet software. 6. The spreadsheet interprets the attacker-controlled cell as a formula. 7. Depending on the spreadsheet client and its security configuration, t ...[truncated 849 chars]
Remediation
View remediation
[ record.date, record.amount, record.currency, record.source, record.note ].map(csvCell).join(',')).join('\r\n'); const csv = `${header}\r\n${rows}`; ``` ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
index.js:103
Finding

Financial Records Stored Without Explicit Restrictive Permissions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

The skill advertises capabilities that imply environment or runtime access, but it does not declare any explicit tool scope or permission boundaries. In a finance-related skill that handles potentially sensitive income data, missing scope declarations increase the risk of over-privileged execution or unintended access to local environment data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The description and all listed triggers and commands are presented in Chinese, with no indication that other languages are supported or that Chinese is an intentional region-specific limitation. Under the policy, forcing a specific language without user opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are broad, generic, and overlap with ordinary user conversation about income, reporting, or analysis. This can cause accidental activation, leading to unintended handling of financial data or execution of tracking actions when the user did not explicitly intend to invoke the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill states that it supports cloud sync and uses real-time exchange-rate interfaces, but it does not clearly disclose what data may be transmitted externally, to whom, or under what conditions. Because the skill processes financial information, undisclosed outbound data flows can expose sensitive income metadata and user activity patterns.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Very short shortcut commands such as '收入', '月报', and '趋势' are highly ambiguous and likely to appear in normal conversation. In this context, accidental invocation is especially risky because the skill concerns sensitive financial records and may expose or modify private income information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file description, user-facing messages, source names, and reporting text are written in Chinese, and the default settings also force Asia/Shanghai and CNY. Under the policy, locale or language constraints should not be imposed without user opt-in or clear justification, and no such opt-in or justification is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Most user-facing natural-language content, including the description, config description, features, and nearly all triggers, is presented only in Chinese. This effectively imposes a language/locale constraint without offering user choice or documenting a region-specific justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger phrase set includes very generic finance-related phrases such as '记录收入' and '查看收入' that can match ordinary user requests broadly, causing the skill to activate in contexts the user may not have intended. Because the skill handles potentially sensitive personal financial data and writes to a local data path, overbroad activation increases the risk of unintended data capture, modification, or disclosure through accidental invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The natural-language description is entirely in Chinese ("收入追踪器 - 多平台收入记录、统计分析、趋势图表") with no indication that other languages are supported or that the package is intentionally limited to a Chinese-speaking region. Under the policy, forcing a specific language without user opt-in is a reportable locale/language issue.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 20)May include surrounding context.

json
"author": "clawd",
  "license": "MIT",
  "dependencies": {
    "asciichart": "^1.5.25",
    "chalk": "^4.1.2",
    "dayjs": "^1.11.10"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 21)May include surrounding context.

json
"license": "MIT",
  "dependencies": {
    "asciichart": "^1.5.25",
    "chalk": "^4.1.2",
    "dayjs": "^1.11.10"
  },
  "devDependencies": {},

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json
"dependencies": {
    "asciichart": "^1.5.25",
    "chalk": "^4.1.2",
    "dayjs": "^1.11.10"
  },
  "devDependencies": {},
  "engines": {

Static analysis

No suspicious patterns detected.