ClawHub
Back to skill

Security audit

Recite

Security checks for vulnerabilities and agentic risk

Overview

This receipt-bookkeeping skill does what it advertises, but it uploads sensitive receipts to a remote API while also claiming to be local-first, and its file-renaming code trusts API data too much.

Install only if you are comfortable sending receipt and invoice contents to the Recite remote API. Use a restricted receipt folder, back up files first, prefer an environment variable or protected secret store for the API key, review long_term_memory.md before runs, and treat the generated CSV as untrusted before opening it in spreadsheet software.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
process_receipts.py:147
Finding

API-Controlled Path Traversal During Receipt Renaming

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
process_receipts.py:81
Finding

Spreadsheet Formula Injection in Generated Bookkeeping CSV

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
README.md:29
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill sends receipt contents to an external API for extraction, but the description does not clearly warn users that sensitive financial documents and likely associated metadata will leave the local environment. Receipts and invoices often contain personally identifiable, financial, tax, and vendor information, so undisclosed exfiltration to a third party materially increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs use of a remote Vision API to scan receipts, which may contain financial and personal information, but does not prominently warn about the privacy implications of transmitting those documents off-device. In an agent context, this omission is dangerous because an automated system may upload sensitive receipts without the user realizing third-party processing is involved.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README presents the skill as 'Local-First' even though receipt images and PDFs are sent to a remote Vision API for extraction. This can mislead users and downstream agents about where sensitive financial documents are processed, reducing informed consent and increasing the chance that confidential data is uploaded unexpectedly.

Content

No source excerpt is available for this finding.

Persistent Context Injection

Medium
Category
Memory Poisoning
Confidence
86% confidence
Finding

The README directs agents to 'Always read' a long-term memory file containing persistent instructions, creating a persistent context injection surface. If that file is modified by an attacker or populated with unsafe directives, future agent runs may inherit untrusted instructions that alter behavior, exfiltrate data, or override user intent.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

md
- **Smart Renaming:** Automatically renames files to `[YYYY-MM-DD]_[Vendor].png/pdf`.
- **Schema-Aware Bookkeeping:** Appends data to `bookkeeping_transactions.CSV`. Handles API response changes without data loss.
- **Local-First:** Keeps your financial data on your machine.
- **Long-Term Memory:** Supports custom persistent instructions (e.g., "Alert if total > $500").

## 🛠️ Setup

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

Persisting the API key in ~/.config/recite/config.json creates a session-persistent secret that may be exposed through weak file permissions, backups, multi-user systems, or later agent access. While common operationally, it increases the attack surface compared with ephemeral secret handling, especially for a skill that interacts with external services and local files.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
Set the API key in your environment or configuration file:
- **Environment:** `export RECITE_API_KEY="re_live_YOUR_API_KEY"`
- **Config:** Create `~/.config/recite/config.json` with `{"api_key": "re_live_..."}`.

### 2. Dependencies
Ensure you have `python3`, `requests`, and `csv` installed.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
77% confidence
Finding

The documentation states the agent MUST verify the Recite API key before performing any scanning, file manipulation, or even listing files. However, the same document presents direct invocation of process_receipts.py as the tool entrypoint, with no indication of an enforced guard in the skill file itself, creating an intent-versus-execution divergence in the documented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill performs destructive or state-changing local actions by renaming files and writing bookkeeping data to disk, but the description does not clearly foreground those side effects as a user warning. That can lead to unintended file mutations, broken user workflows, or accidental processing of sensitive financial records without informed consent.

Content

No source excerpt is available for this finding.

Persistent Context Injection

Medium
Category
Memory Poisoning
Confidence
94% confidence
Finding

The skill instructs the agent to always read a mutable long_term_memory.md file before processing, creating a persistent prompt-injection surface. Anyone able to modify that file can silently alter future behavior, including causing unauthorized file operations, data disclosure, or policy bypasses across sessions.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
## Long-Term Memory & Custom Logic

Modify `skills/recite/long_term_memory.md` to add persistent instructions for the agent. The agent will always read this file before processing.

Examples:
- "After processing, move all files to a sub-folder named `processed/`."

Persistent Context Injection

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.

Content

Scanner excerpt · long_term_memory.md (reported line 1)May include surrounding context.

md
# Recite Long-Term Memory (Persistent Instructions)

This file contains persistent instructions for the Recite agent. Modify this file to customize your bookkeeping workflow.

Persistent Context Injection

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.

Content

Scanner excerpt · long_term_memory.md (reported line 3)May include surrounding context.

md
# Recite Long-Term Memory (Persistent Instructions)

This file contains persistent instructions for the Recite agent. Modify this file to customize your bookkeeping workflow.

## Custom Workflow Instructions
- **File Organization:** After scanning, you can instruct the agent to move files to specific sub-folders (e.g., `processed/2026/`).

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This code performs a network POST to an external API and includes the full receipt image/PDF content in the request body. In the context of bookkeeping receipts, that data can include names, addresses, payment details, itemized purchases, and other confidential business or personal information, making outbound transmission security-relevant and potentially harmful if users are unaware or the service is untrusted.

Content

Scanner excerpt · process_receipts.py (reported line 66)May include surrounding context.

python
}
    
    try:
        response = requests.post(f"{BASE_URL}/scan", headers=headers, json=payload, timeout=30)
        if response.status_code == 200:
            return response.json()
        else:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script base64-encodes local receipt files and sends their full contents to a third-party API endpoint for processing, but it does not provide any explicit notice, consent flow, or data-minimization controls. Receipts commonly contain sensitive financial and personal information, so silent transmission to an external service creates a real confidentiality and privacy risk even if the feature is functionally intended.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.