ClawHub
Back to skill

Security audit

financial-statement-check

Security checks across malware telemetry and agentic risk

Overview

The skill is built for financial statement OCR and reconciliation, but it can automatically send sensitive financial and tax documents to Tencent Cloud without a clear consent gate.

Install only if your organization permits Tencent Cloud OCR to process financial statements, tax returns, and banking-review materials. Require explicit confirmation before each document is uploaded or OCRed, avoid broad auto-triggering, and do not use this skill for confidential or regulated records unless third-party data handling is approved.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger conditions are broad enough to activate on common finance-related requests, not just explicit three-statement reconciliation tasks. Over-triggering can route unrelated user files or prompts into an OCR/data-processing workflow unnecessarily, causing excess data exposure, unexpected costs, and confusing behavior.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The automatic trigger guidance relies on ambiguous filenames and generic intent keywords such as '财报' or '年报', which can match many benign or unrelated scenarios. In a system that auto-invokes skills, this increases the risk of processing the wrong files or sending sensitive financial material to external services without sufficiently specific consent.

Missing User Warnings

High
Confidence
96% confidence
Finding
The skill describes sending uploaded financial statements to Tencent Cloud OCR but does not provide a clear user-facing privacy notice, consent step, or data-sharing warning. Financial reports can contain highly sensitive corporate information, so silent third-party transmission creates a significant confidentiality and compliance risk.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.