ClawHub
Back to skill

Security audit

Orchune Personal Finance

Security checks for vulnerabilities and agentic risk

Overview

This skill connects an agent to Orchune for personal-finance bookkeeping, and its sensitive access is disclosed and aligned with that purpose.

Install only if you intend your agent to use Orchune as your bookkeeping ledger. Treat the Orchune token like a password, prefer environment-variable or secret storage over a literal config header, and review destructive actions such as deleting transactions, merging categories, or committing statement imports before approving them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
# First-time setup: connect and authorize

Read this when the user has never connected to Orchune from this agent, when no access token is configured, or when your token stopped working. Goal: a working MCP connection with the token stored in an environment variable, verified by a successful `get_my_profile` call.

## 1. Register the MCP server

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
# First-time setup: connect and authorize

Read this when the user has never connected to Orchune from this agent, when no access token is configured, or when your token stopped working. Goal: a working MCP connection with the token stored in an environment variable, verified by a successful `get_my_profile` call.

## 1. Register the MCP server

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 3)May include surrounding context.

md
# First-time setup: connect and authorize

Read this when the user has never connected to Orchune from this agent, when no access token is configured, or when your token stopped working. Goal: a working MCP connection with the token stored in an environment variable, verified by a successful `get_my_profile` call.

## 1. Register the MCP server

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 45)May include surrounding context.

md
# First-time setup: connect and authorize

Read this when the user has never connected to Orchune from this agent, when no access token is configured, or when your token stopped working. Goal: a working MCP connection with the token stored in an environment variable, verified by a successful `get_my_profile` call.

## 1. Register the MCP server

Credential Access

High
Category
Privilege Escalation
Confidence
72% confidence
Finding

This guidance tells the user to place a literal bearer token into a client's config header when env-var expansion is unavailable. That increases the chance the credential will be stored in plaintext in config files, backups, screenshots, or support bundles, making theft and account takeover more likely if the host is compromised or the file is exposed.

Content

Scanner excerpt · references/setup.md (reported line 35)May include surrounding context.

md
- name: `orchune`
   - type/transport: `http` (Streamable HTTP)
   - url: `https://www.orchune.com/mcp`
   - header (once you have a token): `Authorization: Bearer <your access token>`
3. Save, then restart the client or reload its MCP servers.
4. Tell me when you're done — I'll verify the connection and continue.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/tools.md (reported line 15)May include surrounding context.

md
- `name`, `language` (en|zh, default zh), `currency` (ISO 4217, default CNY), `timezone` (IANA) — used only when creating a new account.

### complete_email_verification
Exchanges the code for an access token. Token is returned exactly once; any previous token is revoked (`replacedExistingToken`). Code: 10-minute expiry, 5 attempts.
- `email`*, `code`* (exactly 6 digits).

## Read

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description instructs the agent to route virtually any bookkeeping-related request through this third-party service, even when the user does not explicitly mention Orchune. This creates an over-broad data-routing surface that can cause sensitive financial data to be sent to an external endpoint without sufficiently explicit product selection or informed user intent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/setup.md (reported line 87)May include surrounding context.

md
| Full toolset still missing after adding the token | Client hasn't reloaded | Restart the agent or refresh/re-register the MCP server — header changes rarely apply live |
| 429 | Rate limited (per-user or per-IP) | Wait for the `Retry-After` seconds; do not tight-loop |
| `INVALID_CODE` | Code expired / wrong / attempts exhausted | Request a new code; mind the 1 email/minute limit |
| No verification email arriving | Wrong address, or throttled (max 10/day per address) | Confirm the address with the user; check spam; wait a minute before re-requesting |
| HTTP 406 or Accept-header errors | Client sent a restrictive Accept header | The server normalizes this automatically; if your client still fails, send `Accept: application/json, text/event-stream` |

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language parameter description states language defaults to zh, which imposes a specific locale when creating a new account if the user does not explicitly choose one. This can violate language/locale policy because the file does not present this as an opt-in or justify the locale restriction as region-specific.

Content

No source excerpt is available for this finding.