ClawHub
Back to skill

Security audit

Personal Money Tracker Pro

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local money-tracking skill, but it can permanently change or delete financial records without a built-in confirmation step.

Install only if you are comfortable with a local finance tool that can immediately modify and delete records. Keep backups of the SQLite database, avoid vague deletion requests such as deleting the latest entry, and assume command outputs may contain sensitive transaction details.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill includes direct destructive commands such as delete-entry, delete-latest-entry, delete-account, delete-category, and delete-recurring, but the response rules do not require a confirmation or clear warning before executing irreversible actions. In an agent setting, ambiguous user phrasing or prompt injection through conversation history could cause unintended data loss in the user's local bookkeeping database.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The documentation exposes destructive operations like deleting entries, categories, accounts, and recurring schedules without any confirmation, preview, or explicit user-safety guidance. In a natural-language bookkeeping skill, an agent could misinterpret a user request and irreversibly remove financial records, making this more dangerous than a typical CLI-only delete command reference.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The tool emits the resolved database path and full accounting data in JSON responses, which can leak sensitive financial information and filesystem details into agent logs, chat transcripts, telemetry, or downstream tools. In an agent skill context, this is more dangerous because outputs are often persisted or shared outside the user's immediate terminal session.

Static analysis

No suspicious patterns detected.