T09 · Insecure Skill Coding Practices
Warning
- Location
src/db.py:70- Finding
Spreadsheet Formula Injection in Receipt Exports
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawReceipt
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims, but it can persist and export sensitive financial records with weak safeguards.
Install only in an isolated virtual environment, review and pin dependencies first, and treat receipt exports as sensitive files. Before letting an agent add receipts or set a budget, require explicit confirmation because those actions persist local financial records.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Unpinned and Unnecessary Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (20)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to run commands that add receipts and potentially alter budget-related records, but it does not explicitly warn that these operations persistently modify the user's financial data. In an agent setting, this can lead to unintended state changes if the user expected analysis or extraction only, especially because financial records are sensitive and cumulative.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The
budget --set <Amount>workflow overwrites the user's existing monthly budget, but the skill does not clearly warn that this replaces prior stored configuration. Without a confirmation step, an agent could irreversibly change budgeting state based on an ambiguous or misheard request, affecting future financial tracking and alerts.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code presents command descriptions and help text in Thai and Chinese string literals, which imposes a specific language/locale on users with no opt-in or alternative. The policy for natural-language violations applies to all file types, including code string literals, so forcing localized UX without choice is in scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The export_to_csv and export_to_excel functions write receipt data to whatever filename is provided, with no path validation, directory restriction, or overwrite protection. If an attacker or untrusted caller controls the filename, they could overwrite arbitrary files accessible to the process or place sensitive financial data in unintended locations, which is more concerning in a skill that handles receipts and budget data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code presents key status and spending information only in Thai, and similar Thai-only strings appear in notifications elsewhere in the file. That creates a language/locale policy issue because the skill forces a specific language without user opt-in or an explicitly documented regional justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The refresh and export success messages are shown only in Thai, which enforces a specific locale in user-facing interactions. Under the policy, this should not be forced unless the skill offers a choice or clearly documents a justified region-specific scope.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The markdown file states that the skill exports receipt data to CSV or Excel, which can affect user data privacy and persistence, but it does not include any caution about sensitive financial information being written to files. Under the markdown-specific warning criteria, data-affecting behavior should be disclosed to users.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
The README uses Thai-specific examples such as '5,000 Baht' and a Thai category value 'อาหาร', which suggests a locale-specific workflow, but it does not clearly state that the skill is region-specific or that users may choose their own language/locale conventions. This can violate the language/locale policy when a specific locale is implied without opt-in or justification.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The dependency 'textual' is unpinned, so builds may resolve to different versions over time. This increases supply-chain risk and can unexpectedly introduce breaking changes or newly vulnerable releases into the environment.
- Content
text textual rich pandas openpyxl
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The dependency 'rich' is unpinned, which makes installations non-reproducible and exposes the skill to accidental adoption of malicious or vulnerable upstream releases. Even if 'rich' is commonly safe, leaving it unconstrained is still a supply-chain weakness.
- Content
text textual rich pandas openpyxl pydantic
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The dependency 'pandas' is unpinned, so the installed version is uncontrolled and may drift into vulnerable or incompatible releases. Because this skill processes financial receipt data, dependency unpredictability raises operational and supply-chain risk.
- Content
text textual rich pandas openpyxl pydantic pillow
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
Because 'pandas' is not version-pinned, it is impossible to verify whether the deployed version includes fixes for known advisories. This is not proof that the package is vulnerable, but it is a real security weakness because vulnerable versions could be installed unnoticed.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The dependency 'openpyxl' is unpinned, which is risky because spreadsheet-processing libraries have historically had parser-related issues. Uncontrolled upgrades can expose the skill to vulnerable versions or unexpected parser behavior when handling untrusted files.
- Content
text textual rich pandas openpyxl pydantic pillow python-dotenv
Unverifiable Dependency: openpyxl has 2 known advisory(ies) (CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
Because 'openpyxl' is unpinned, the project may resolve to versions affected by historical XML entity and parser-related issues. In a receipt-management context that may import spreadsheet files, this makes the dependency ambiguity more dangerous than a purely theoretical concern.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The dependency 'pydantic' is unpinned, allowing different installations to pull different releases with different security characteristics. Since this library often handles validation logic, version drift can affect both safety and correctness.
- Content
text rich pandas openpyxl pydantic pillow python-dotenv
Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
Because 'pydantic' is not pinned, the application may install a release affected by known denial-of-service or parsing issues without any visibility. This weakens assurance around input validation, which is a core security control.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The dependency 'pillow' is unpinned, which is more concerning because image parsing libraries frequently receive security fixes for crafted-file attacks. This receipt-processing skill likely handles user-supplied images, so an unsafe Pillow release could increase exposure to denial-of-service or worse parser exploits.
- Content
text pandas openpyxl pydantic pillow python-dotenv
Unverifiable Dependency: pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
Because 'pillow' is unpinned and has a long history of image-parsing vulnerabilities, the skill may install a version susceptible to crafted-image attacks. This is especially relevant here because receipt extraction likely processes untrusted image inputs, increasing the chance of denial-of-service or potentially code-execution exposure depending on the version.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The dependency 'python-dotenv' is unpinned, making the environment setup behavior dependent on whichever release is installed at runtime. This creates avoidable supply-chain and configuration-handling risk, especially for tools that may manage local files or secrets.
- Content
text openpyxl pydantic pillow python-dotenv
Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
Because 'python-dotenv' is unpinned, the project may consume a release with known file-handling weaknesses, including advisory-relevant unsafe overwrite behavior. In tools that may run locally with user permissions, this could enable harmful file modifications if vulnerable functionality is used.
- Content
Static analysis
No suspicious patterns detected.