ClawHub
Back to skill

Security audit

TokenBooks Cross-Provider AI Spend Dashboard

Security checks across malware telemetry and agentic risk

Overview

TokenBooks is a coherent local spending dashboard, but it should be reviewed because it saves sensitive billing reports and generates HTML from imported fields without escaping them.

Use this only with billing exports you trust, keep generated JSON and HTML reports out of shared folders and repositories, and review dashboards before sharing them. Treat the HTML report as sensitive until the project escapes imported fields before rendering.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill encourages importing provider billing exports and generating local JSON/HTML artifacts without warning that those files may contain sensitive account, usage, project, or task metadata. Users may persist and later share dashboards or data files that expose internal workloads, API usage patterns, model choices, or billing details, creating an information disclosure risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.