ClawHub
Back to skill

Security audit

Orchune Personal Finance

Security checks for vulnerabilities and agentic risk

Overview

This skill connects an agent to Orchune for personal-finance bookkeeping, and its sensitive access is disclosed and aligned with that purpose.

Install only if you intend your agent to use Orchune as your bookkeeping ledger. Treat the Orchune token like a password, prefer environment-variable or secret storage over a literal config header, and review destructive actions such as deleting transactions, merging categories, or committing statement imports before approving them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Credential Access

High
Category
Privilege Escalation
Content
# First-time setup: connect and authorize

Read this when the user has never connected to Orchune from this agent, when no access token is configured, or when your token stopped working. Goal: a working MCP connection with the token stored in an environment variable, verified by a successful `get_my_profile` call.

## 1. Register the MCP server
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# First-time setup: connect and authorize

Read this when the user has never connected to Orchune from this agent, when no access token is configured, or when your token stopped working. Goal: a working MCP connection with the token stored in an environment variable, verified by a successful `get_my_profile` call.

## 1. Register the MCP server
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# First-time setup: connect and authorize

Read this when the user has never connected to Orchune from this agent, when no access token is configured, or when your token stopped working. Goal: a working MCP connection with the token stored in an environment variable, verified by a successful `get_my_profile` call.

## 1. Register the MCP server
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# First-time setup: connect and authorize

Read this when the user has never connected to Orchune from this agent, when no access token is configured, or when your token stopped working. Goal: a working MCP connection with the token stored in an environment variable, verified by a successful `get_my_profile` call.

## 1. Register the MCP server
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
- name: `orchune`
   - type/transport: `http` (Streamable HTTP)
   - url: `https://www.orchune.com/mcp`
   - header (once you have a token): `Authorization: Bearer <your access token>`
3. Save, then restart the client or reload its MCP servers.
4. Tell me when you're done — I'll verify the connection and continue.
Confidence
72% confidence
Finding
This guidance tells the user to place a literal bearer token into a client's config header when env-var expansion is unavailable. That increases the chance the credential will be stored in plaintext in config files, backups, screenshots, or support bundles, making theft and account takeover more likely if the host is compromised or the file is exposed.

Credential Access

High
Category
Privilege Escalation
Content
- `name`, `language` (en|zh, default zh), `currency` (ISO 4217, default CNY), `timezone` (IANA) — used only when creating a new account.

### complete_email_verification
Exchanges the code for an access token. Token is returned exactly once; any previous token is revoked (`replacedExistingToken`). Code: 10-minute expiry, 5 attempts.
- `email`*, `code`* (exactly 6 digits).

## Read
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill description instructs the agent to route virtually any bookkeeping-related request through this third-party service, even when the user does not explicitly mention Orchune. This creates an over-broad data-routing surface that can cause sensitive financial data to be sent to an external endpoint without sufficiently explicit product selection or informed user intent.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| Full toolset still missing after adding the token | Client hasn't reloaded | Restart the agent or refresh/re-register the MCP server — header changes rarely apply live |
| 429 | Rate limited (per-user or per-IP) | Wait for the `Retry-After` seconds; do not tight-loop |
| `INVALID_CODE` | Code expired / wrong / attempts exhausted | Request a new code; mind the 1 email/minute limit |
| No verification email arriving | Wrong address, or throttled (max 10/day per address) | Confirm the address with the user; check spam; wait a minute before re-requesting |
| HTTP 406 or Accept-header errors | Client sent a restrictive Accept header | The server normalizes this automatically; if your client still fails, send `Accept: application/json, text/event-stream` |
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Low
Confidence
95% confidence
Finding
The natural-language parameter description states `language` defaults to `zh`, which imposes a specific locale when creating a new account if the user does not explicitly choose one. This can violate language/locale policy because the file does not present this as an opt-in or justify the locale restriction as region-specific.

Static analysis

No suspicious patterns detected.