ClawHub
Back to skill

Security audit

Personal Finance Tracker

Security checks for vulnerabilities and agentic risk

Overview

This finance skill is coherent and not malicious, but it can modify and delete personal finance records without clearly requiring confirmation for destructive actions.

Install only if you trust the assistant CLI and are comfortable letting the skill change your finance database. Before using deletion commands, require the agent to repeat the exact transaction or category and wait for your explicit confirmation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
## Constraints

- NEVER create transactions without confirming ambiguous details first
- Always respond in the same language as the user's message (default: Russian)
- Keep responses short and action-oriented — no unnecessary explanations
Confidence
70% confidence
Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger list contains broad, common words such as 'bought', 'paid', 'balance', and 'report', which can cause the finance skill to activate on casual conversation or unrelated requests. In a skill that can create and delete financial records, over-triggering materially raises the risk of unauthorized or accidental state-changing actions.

Intent-Code Divergence

Medium
Confidence
78% confidence
Finding
The manifest says the skill should not trigger for creating/modifying database structure, yet the workflow later instructs the agent to create a category when one does not exist. While category creation is data creation rather than schema migration, the documentation presents a stricter exclusion that conflicts with later instructions to perform a create operation related to database-backed entities.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill exposes wallet/category creation and deletion operations that expand beyond the narrowly described transaction-recording use case and include destructive data changes. In a finance context, undocumented or weakly scoped mutation capabilities increase the chance of unintended data loss or abuse if the skill is triggered incorrectly or the agent infers actions too aggressively.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documented availability of delete-transaction and delete-category operations without mandatory confirmation or warning creates a direct path to accidental or malicious data destruction. In a personal-finance skill, deleting records can corrupt balances, reports, and auditability, making the impact more severe than in a read-only or low-stakes context.

Static analysis

No suspicious patterns detected.