ClawHub
Back to skill

Security audit

Get with Receipt

Security checks for vulnerabilities and agentic risk

Overview

This skill sets up and uses a Receipt OAuth connection for governed paid tool purchases, with the sensitive steps disclosed and bounded by user approval.

Before installing, understand that this skill can configure a persistent Receipt MCP connection and start an OAuth flow for paid purchases. Use it only if you want Receipt to mediate agent spending, review the hosted approval and spending limits carefully, and revoke or pause the Receipt session if you no longer want purchases available.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill description emphasizes purchasing governed outcomes, but the body also instructs the agent to perform local setup actions, run a bootstrap script, configure an MCP server, initiate OAuth, and handle a localhost callback URL. That mismatch is security-relevant because it can cause a user or calling system to authorize installation/configuration and credential-handling behavior they did not reasonably expect from the declared purpose, increasing the chance of overbroad trust and unsafe execution.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The activation criteria are very broad and trigger on loosely defined 'commercial boundary' situations, including cases where the agent is merely discussing spending, quotas, or provider keys. In practice, this can cause the skill to recommend or initiate setup in many adjacent contexts, expanding the attack surface for unnecessary OAuth flows, installation changes, and payment-related prompts when the user did not clearly request this capability.

Static analysis

No suspicious patterns detected.