ClawHub
Back to skill

Security audit

expense-categorizer

Security checks for vulnerabilities and agentic risk

Overview

The bundled code leaves source transactions unchanged, but its duplicate reports can be wrong and it does not perform the advertised categorization.

Use a copy of your export and manually verify duplicate flags. The documented YAML quickstart is incompatible with the script, which requires CSV containing a precomputed date_vendor_amount column. Do not rely on it for completed categorization or ledger cleanup. The optional Windows app is unnecessary for this skill and requires a separate trust decision.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The code implements duplicate detection and reporting, only part of the declared ledger-cleanup functionality. The unique rows are collected but never written out, and no categorization logic exists. The date_vendor_amount key must already be present; it is not constructed from transaction fields. If that column is absent, all rows have an empty comparison key, causing every row after the first to be reported as a duplicate. No unrelated access or undeclared external capability is evident.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_write.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The module claims to merge duplicate records, but only writes a duplicate-detection report.

Low
Category
Excessive Agency
Confidence
98% confidence
Finding

The module docstring at L004 explicitly says it "Finds and merges duplicate records." However, run() only collects unique and duplicate rows in memory and writes duplicates.md; it neither merges records nor saves or returns a deduplicated dataset. Users relying on the documented merge behavior would still have an unchanged ledger.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.