ClawHub
Back to skill

Security audit

Revenue Dashboard

Security checks for vulnerabilities and agentic risk

Overview

This Stripe revenue skill mostly does what it says, but it handles sensitive Stripe credentials and financial data in ways users should review carefully before installing.

Review this skill before installing. Use a restricted read-only Stripe key if possible, store it with tight permissions, avoid running it on shared or heavily monitored machines, and narrow when the skill is invoked so ordinary revenue discussions do not automatically access Stripe data.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/revenue.py:105
Finding

Stripe Secret Key Exposed in Process Command-Line Arguments in Revenue Reporting

Content
View full analysis
/cmdline`, `ps`, audit logs, endpoint monitoring, or process telemetry. The credential remains exposed for the lifetime of each `curl` process. Pagination and multi-account reporting can create multiple opportunities to observe it. The key is a Stripe secret rather than a restricted ephemeral token. Its effective authority depends on how the key was provisioned. ### Attack Path 1. An attacker first obtains local code execution or process-inspection access on the host, under an account permitted to inspect the reporting process. 2. The attacker monitors process creation or repeatedly queries available process metadata. 3. A user or scheduled workflow invokes `scripts/revenue.py`. 4. The script starts `curl` with `-u sk_...:` in its process argument vector. 5. The attacker captures the argument vector and extracts the Stripe secret key. 6. The attacker sends authenticated requests to Strip ...[truncated 900 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/mrr.py:34
Finding

Stripe Secret Key Exposed in Process Command-Line Arguments in MRR Reporting

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code is narrowly focused on pulling active Stripe subscriptions and calculating MRR/ARR and subscription counts across multiple accounts, with optional plan-level breakdowns. That partially matches the declared description around Stripe metrics and MRR/ARR. However, the declared purpose substantially overstates the skill: there is no automation/scheduling for daily reports, no goal tracking, no anomaly detection or alerting, no comparison of time periods, no churn analysis, and no general revenue or sales performance answering capability. The accessed resource (Stripe) is consistent, but the implemented behavior is materially narrower than the declared description.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill documents direct shell execution of local Python scripts but does not declare any explicit tool scope or allowed-tools boundary. That creates unnecessary ambiguity about what execution capabilities the skill needs, making it easier for an agent or operator to invoke shell access more broadly than intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger language is extremely broad and includes common business terms like revenue, growth rate, churn, and sales numbers. That can cause the skill to activate in many unrelated conversations, increasing the chance of unnecessary access to financial data or execution of local scripts in contexts where the user did not intend to invoke this capability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation tells users to store a Stripe secret key in a local file without any warning about secret sensitivity, file permissions, rotation, or safer secret-management options. Because Stripe secret keys grant access to sensitive financial account data and potentially operational actions, poor handling materially raises the risk of credential theft or accidental exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code performs outbound API requests to Stripe using account credentials and retrieves subscription data, but the script provides no user-facing disclosure before making the network call. Aside from the module docstring stating its purpose, there is no runtime warning, confirmation, or explicit notice about external data access/transmission.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mrr.py (reported line 39)May include surrounding context.

python
headers.extend(["-H", f"Stripe-Account: {acct_id}"])

    all_data = []
    url = f"https://api.stripe.com/v1/{endpoint}"

    while url:
        result = subprocess.run(

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mrr.py (reported line 59)May include surrounding context.

python
headers.extend(["-H", f"Stripe-Account: {acct_id}"])

    all_data = []
    url = f"https://api.stripe.com/v1/{endpoint}"

    while url:
        result = subprocess.run(

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/revenue.py (reported line 93)May include surrounding context.

python
headers.extend(["-H", f"Stripe-Account: {acct_id}"])

    all_data = []
    url = f"https://api.stripe.com/v1/{endpoint}"

    while url:
        result = subprocess.run(

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/revenue.py (reported line 113)May include surrounding context.

python
headers.extend(["-H", f"Stripe-Account: {acct_id}"])

    all_data = []
    url = f"https://api.stripe.com/v1/{endpoint}"

    while url:
        result = subprocess.run(

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mrr.py (reported line 42)May include surrounding context.

python
url = f"https://api.stripe.com/v1/{endpoint}"

    while url:
        result = subprocess.run(
            ["curl", "-s", "-g", url] + headers,
            capture_output=True, text=True
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/revenue.py (reported line 96)May include surrounding context.

python
url = f"https://api.stripe.com/v1/{endpoint}"

    while url:
        result = subprocess.run(
            ["curl", "-s", "-g", url] + headers,
            capture_output=True, text=True
        )