ClawHub
Back to skill

Security audit

QBO Automation

Security checks for vulnerabilities and agentic risk

Overview

This QuickBooks skill is legitimate accounting automation, but it uses powerful financial credentials and live write operations without enough safeguards.

Install only if you intend an agent to help with QuickBooks automation. Use a QBO sandbox first, provide least-privilege credentials through secure environment or secret storage, never paste or log tokens, and require explicit human approval before any production write to accounts, journal entries, or recurring transactions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The code directly accesses highly privileged financial API credentials from environment variables and immediately exchanges them for an access token. In a documentation skill, showing credential access without accompanying restrictions encourages patterns that may expose secrets through debugging, logging, insecure runtime environments, or over-broad agent permissions.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md
import requests, json, base64, os

def get_access_token():
    """Exchange refresh token for access token."""
    credentials = base64.b64encode(
        f"{os.environ['QBO_CLIENT_ID']}:{os.environ['QBO_CLIENT_SECRET']}".encode()
    ).decode()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill requires QBO client ID, client secret, refresh token, and realm ID but does not prominently warn that these grant access to company financial data and should be handled as secrets. In an agent setting, omission of privacy and credential-safety guidance materially raises the risk of accidental disclosure through prompts, logs, or shared environments.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly instructs operators to store and use QBO client credentials and refresh tokens, which are sensitive secrets that enable API access to financial systems. Although using credentials is expected for QBO automation, the documentation lacks clear handling safeguards and conflicts with the claim that OAuth setup is out of scope, increasing the chance of unsafe secret exposure or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This section provides direct write operations that can create or alter chart-of-accounts data in a live QuickBooks company, but it does not clearly warn that execution mutates authoritative accounting records. In accounting contexts, unintended writes can corrupt books, impact reporting, and require manual remediation or audit follow-up.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The negative-boundary text says OAuth setup is not covered, but the code performs refresh-token exchange to obtain an access token. That inconsistency can mislead users and agents into handling authentication material inside a skill that claims not to, expanding the trust boundary around highly sensitive credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
credentials = base64.b64encode(
        f"{os.environ['QBO_CLIENT_ID']}:{os.environ['QBO_CLIENT_SECRET']}".encode()
    ).decode()
    resp = requests.post(
        "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer",
        headers={
            "Authorization": f"Basic {credentials}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md
}
    if acct_num:
        payload["AcctNum"] = acct_num
    resp = requests.post(
        f"https://quickbooks.api.intuit.com/v3/company/{realm_id}/account",
        headers={
            "Authorization": f"Bearer {access_token}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

md
}
        ]
    }
    resp = requests.post(
        f"https://quickbooks.api.intuit.com/v3/company/{realm_id}/recurringtransaction",
        headers={
            "Authorization": f"Bearer {access_token}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 355)May include surrounding context.

md
"Line": line_items
    }
    
    resp = requests.post(
        f"https://quickbooks.api.intuit.com/v3/company/{realm_id}/journalentry",
        headers={
            "Authorization": f"Bearer {access_token}",

Static analysis

No suspicious patterns detected.