ynab

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). At runtime, the skill uses ClawLink’s CLI to log in/connect to YNAB and then “reads” YNAB data via browser/OAuth-backed API calls; that retrieved YNAB content (e.g., transaction descriptions, payee notes, budget item text) is outsider-authored free text from YNAB’s system and is ingested into the agent’s LLM context through the CLI’s fetched responses.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs the agent to run npx @useclawlink/cli at runtime, which will fetch and execute remote code from the npm package (https://www.npmjs.com/package/@useclawlink/cli) and interact with the ClawLink service (https://claw-link.dev), so external code is executed and relied upon during runtime.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill exposes a dedicated YNAB integration via the ClawLink CLI that lets the agent list actions and execute them (npx @useclawlink/cli run ynab --input ''). It explicitly states the agent can "read and act on" YNAB and perform writes (after a read/confirm step). YNAB is a personal-finance/budgeting system, and the tool is specifically designed to modify budgets/transactions stored there (i.e., directly update financial records). This is not a generic browser or HTTP tool but a specific integration for financial operations, so it grants direct financial execution authority.