Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed expense tracker that uses the declared SkillBoss API and persistent KV storage for its stated purpose, with privacy considerations users should understand before use.
Install only if you are comfortable sending expense descriptions, merchant-like details, dates, categories, and budget context to the SkillBoss API and storing expense records in SkillBoss KV storage across sessions. Avoid entering highly sensitive financial account numbers or credentials, and check whether the publisher provides retention and deletion controls.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
def pilot(body: dict) -> dict:
r = requests.post(
f"{API_BASE}/pilot",
headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
json=body,
The skill declares use of environment variables and network-backed API functionality but does not define any explicit tool scope such as permissions or allowed-tools. This creates ambiguity about what capabilities the skill may exercise at runtime, weakening least-privilege controls and making misuse of network or secret access harder to audit.
The trigger phrase 'log expense' begins with the built-in command keyword 'log', which can create shadowing or ambiguous routing between the platform command and this skill. Such collisions can cause accidental invocation, user confusion, or interception of intents that were meant for a built-in feature rather than the third-party skill.
The skill explicitly states that expense data persists across sessions and that expenses can be exported to CSV, but it does not clearly warn users about retention, sensitivity of financial data, or the consequences of export. Because expense records may contain personal financial information, users may unknowingly store or export sensitive data in ways that increase privacy and data-leakage risk.
The skill sends raw user expense and budgeting content to an external AI service, which introduces a privacy and data-handling risk that is not clearly disclosed by the stated local expense-tracking purpose. Because expense descriptions can contain sensitive financial details, this expands exposure to third-party processing and retention.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
from datetime import datetime
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
API_BASE = "https://api.heybossai.com/v1"
EXPENSE_SYSTEM_PROMPT = """You are an expense tracking assistant. Your tasks:
1. Parse natural language expense descriptions and extract: amount, description, category, date.
User messages and derived budget context are transmitted to an external service via requests.post, creating a real outbound data exposure path. In an expense-tracking context, this is more sensitive than ordinary chat because the content may reveal spending habits, merchants, dates, and budget limits.
def pilot(body: dict) -> dict:
r = requests.post(
f"{API_BASE}/pilot",
headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
json=body,
No suspicious patterns detected.