ClawHub
Back to skill

Security audit

Family Financial Planner

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent local family-finance dashboard generator, but the generated HTML should be treated as a private financial document.

Install only if you are comfortable sharing the requested financial details with your agent and storing them in the generated HTML. Keep the dashboard private, avoid putting unnecessary personal identifiers in it, escape or sanitize any free-text values before inserting them into the template, and remove the Google Fonts link if you need a fully offline file.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The template is explicitly designed to replace placeholders with user data and then render large HTML fragments via innerHTML. If any of those values contain attacker-controlled HTML or script-like payloads, the dashboard can become an XSS sink, exposing highly sensitive family financial information and enabling arbitrary script execution in the viewer's browser.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.