ClawHub
Back to skill

Security audit

SpendCap

Security checks across malware telemetry and agentic risk

Overview

SpendCap connects a user's Receipt account so they can set and enforce spending limits, and the reviewed artifacts disclose that connection and avoid setup-time purchases.

Before installing, understand that SpendCap will connect or reuse a Receipt OAuth account in OpenClaw and make Receipt tools available to the agent. Only proceed if you trust the Receipt service and want purchases governed through Receipt; verify the owner authorization URL and use Pause/Revoke controls if the connection should no longer spend.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
The skill’s declared purpose is spend control, but its instructions also drive OAuth connection/bootstrap, clipboard-based OAuth completion, and tool-boundary verification. That mismatch is security-relevant because users may consent to a budgeting skill without realizing it will establish or modify external service connectivity and handle sensitive authorization flow artifacts, expanding trust and attack surface beyond the stated purpose.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The script performs OAuth completion and logs the user into a third-party Receipt account via `openclaw mcp login receipt --code`, then verifies and enables a tool boundary. That account-bootstrap behavior is materially more privileged than a simple local spending-limit helper and is not clearly reflected in the skill description, creating a deceptive capability mismatch that could cause users or reviewers to authorize account linking they did not expect.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.