agent-money-tracker
Verdict safe, but 2 findings (2 medium), mainly social engineering, unauthorized tool use. Most recent scan 2026-02-06.
This skill has MEDIUM severity issues primarily related to format confusion and missing dependencies. The skill presents itself as a TypeScript npm library rather than a proper Agent Skill package, making it non-functional in the agent context. The missing 'natural.py' file creates a potential security vector for tool poisoning attacks. While no active malicious code was detected (no scripts are present), the fundamental mismatch between claimed functionality and actual deliverable format, combined with missing dependencies, makes this skill unreliable and potentially exploitable. The skill requires significant restructuring to function as an actual Agent Skill with proper Python/Bash scripts and agent-executable instructions.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Intelligent budget tracking and financial management library for AI agents - expense tracking, income management, budgets, savings goals, and LLM-powered insights
- Package
- 1 file, 6.6 KB
- SKILL.md
- 821 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: Agent Money Tracker · Installation · Usage · Initialize the Budget Tracker · Expense Tracking · Income Tracking · Budget Management · Savings Goals · Analytics & Reports · Smart Insights · Recurring Transactions · Data Management
Findings
MEDIUM Misleading Skill Description - TypeScript Library Presented as Agent Skill Social Engineeringllm
The skill presents itself as a TypeScript/npm library ('npm install agent-money-tracker') with TypeScript code examples, but Agent Skills are local directory packages containing SKILL.md with markdown instructions and optional Python/Bash scripts. This is a fundamental mismatch between the claimed format (TypeScript library) and the actual Agent Skill format. The instructions contain no actionable guidance for an agent - only npm installation commands and TypeScript API documentation that cannot be executed in the Agent Skill context.
Installation section shows 'npm install agent-money-tracker' and all code examples use TypeScript syntax like 'import { clawhub } from 'agent-money-tracker'' and 'await clawhub.initialize()' which are not compatible with Agent Skill execution model.MEDIUM Missing Referenced File - Potential Tool Poisoning Vector Unauthorized Tool Usellm
The instructions reference a file 'natural.py' that does not exist in the skill package. This creates an undefined dependency that could be exploited through tool shadowing or file injection attacks. An attacker could potentially supply a malicious 'natural.py' file that would be executed by the agent when attempting to use natural language parsing features mentioned in the instructions.
Instructions mention natural language parsing functionality ('await clawhub.addFromNaturalLanguage') and reference file 'natural.py' is listed but marked as 'not found' in the package contents.What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 6.6 KB |
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/intelligent-budget-tracker
- Raw scan result: intelligent-budget-tracker-scan.json
- Badge for your README:
- Request a re-scan