ClawHub
Back to skill

Security audit

Card Optimizer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent credit-card rewards helper that stores user-provided card and spending estimates locally, with no executable code or hidden behavior found.

Before installing, be aware that the skill may create a local file containing your cards, annual fees, reward preferences, signup bonus details, and optional spending estimates. Avoid entering full card numbers, account credentials, or transaction history, and verify any web-searched card terms against issuer sources before relying on them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill instructs storing sensitive financial preference and spending-estimate data in local files without any privacy guidance, retention limits, access controls, or warning to the user. Even if it avoids full transaction history, card portfolio details, annual fees, signup bonuses, and category spending estimates are still sensitive profiling data that could expose financial habits if accessed by other tools or users.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The documentation explicitly states the skill does NOT track individual purchases, yet the core workflow is to answer per-purchase prompts like "which card for [category]?" and "I'm buying [item]" by identifying the purchase category and returning a recommendation. While this may not imply persistent transaction logging, it does mean the skill processes individual purchase events, which materially narrows the accuracy of the "does NOT track individual purchases" claim.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The manifest frames the skill as operating on user-provided card data, but the body expands scope to researching cards via web search and using external reward data. That introduces unbounded external data access, increasing attack surface through prompt-injection in web content, stale or manipulated card terms, and unexpected data flows not disclosed in the high-level description.

Static analysis

No suspicious patterns detected.