ClawHub
Back to skill

Security audit

Norman: Find Receipts

Security checks for vulnerabilities and agentic risk

Overview

This receipt-finding skill is coherent and purpose-aligned, but users should review sensitive searches and Norman accounting changes before applying them.

Install only if you expect the agent to work with Norman transaction records and receipts. Before allowing uploads, links, or verification changes, review the file, vendor, amount, date, and matched transaction, and keep any email/cloud/photo searches narrowly scoped.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill description uses broad trigger phrases like 'missing receipts' and 'finding invoices from emails,' which can match common user requests and cause the skill to activate in situations involving sensitive financial or email data without clear narrowing conditions. In this context, over-broad invocation increases the chance of the agent steering users toward accessing private mail and documents when a less invasive workflow might suffice.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly instructs searching Gmail, cloud storage, vendor portals, and photo libraries for receipts, but gives no privacy warning, consent checkpoint, or guidance to minimize exposure of unrelated personal data. Because these sources commonly contain highly sensitive information, the workflow can lead to unnecessary disclosure or broad data access beyond the immediate business purpose.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- AWS: `from:aws subject:"invoice available"`
  - Google: `from:payments-noreply@google.com`
  - Apple: `from:apple subject:receipt`
  - Amazon: `from:auto-confirm@amazon subject:Bestellung`

**Other sources:**
- Check vendor portals (suggest logging into the vendor's website to download invoices)
Confidence
85% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The upload and verification steps direct the agent to upload documents, attach them to transactions, and mark transactions as verified without an explicit warning that these are consequential accounting actions. This creates a risk of users unintentionally submitting incorrect or sensitive files and prematurely verifying records, which could affect bookkeeping accuracy and auditability.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The skill presents Germany-specific legal and tax statements as general tips without clearly limiting them to German users or asking for jurisdictional context. Users outside Germany may rely on incorrect compliance guidance, and even German users may misapply simplified legal statements without professional review.

Static analysis

No suspicious patterns detected.