ClawHub
Back to skill

Security audit

Agent Revenue Tracker

Security checks for vulnerabilities and agentic risk

Overview

This is a local command-line revenue ledger that writes user-entered records to its own data file and does not show hidden network, credential, or destructive behavior.

Install only if you are comfortable keeping revenue entries in a local JSON ledger inside the skill directory. Do not enter secrets or wallet private keys; this tool only needs payment source names, amounts, agent names, and categories.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares only `allowed-tools: Bash` but also describes behavior that creates and writes a local ledger file (`/home/workspace/Skills/agent-revenue-tracker/data/ledger.json`). Undeclared file-write capability is a real security concern because it expands the skill's effective privileges beyond what is transparently declared, making it harder for reviewers and users to assess what state the skill can modify.

Static analysis

No suspicious patterns detected.