ClawMart Auto Invoice

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:18 PM UTC
• Version:
  1.0.0

Overview

This is a coherent invoice helper skill, but users should treat it as handling sensitive financial and customer data.

Before using this with real invoices, confirm where generated PDFs and invoice records are stored, how they can be deleted or exported, who can access them, and whether GLM-5 or any other provider receives the data. Avoid storing unnecessary bank or tax details, and manually review invoices and reports before sending or relying on them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill is designed to generate invoices, track payment status, produce financial reports, and use local storage, which necessarily involves handling sensitive personal and financial data such as client names, contact details, bank account information, tax IDs, and payment status. Without any warning, retention notice, or privacy guidance, users may expose regulated or confidential data without understanding the storage and processing risks.

VirusTotal

66/66 vendors flagged this skill as clean.