ClawHub
Back to skill

Security audit

utility-bill-analyzer

Security checks across malware telemetry and agentic risk

Overview

This skill is a local utility-bill tracker that stores user-entered bill records in a JSON file and does not show hidden network, credential, or background behavior.

Install only if you are comfortable storing utility usage and cost history in a local JSON file. Use the default database path or a dedicated file path, because providing --db points the tool at the file it will read and, for add, overwrite with its database format.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill advertises file read/write behavior via a local JSON database and configurable `--db` path, but it does not declare any permissions. Undeclared storage access weakens trust and reviewability because users and the platform cannot clearly assess what files the skill may read or modify, especially when a custom path can redirect writes to unintended locations.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.