Tally Prime Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:48 AM UTC
• Version: 1.0.1

Overview

This is a coherent TallyPrime accounting helper, but it needs review because it can make persistent accounting changes, install an unpinned global tool, and send accounting data to a configurable HTTP endpoint.

Install only if you are comfortable letting the skill read and write your TallyPrime accounting data. Keep TALLY_URL pointed to a trusted local Tally instance, review every proposed voucher and master creation before allowing it, and avoid the documented global npm install unless you deliberately choose and trust the exact tallyca version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:12

Finding

Unrestricted Tally endpoint may expose sensitive accounting data over plaintext HTTP

Content

View full analysis

FldName, FldGSTIN, FldPlaceOfSupply, FldRegType, FldAddr1 $Name $PARTYGSTIN $PriorStateName $GSTRegistrationType $Address ``` ### Technical Analysis The Skill declares that it connects to a locally running TallyPrime instance, but it accepts `TALLY_URL` without requiring a loopback destination or secure transport. The examples also normalize the use of plaintext HTTP. The endpoint receives XML requests that can contain or return: - Company and ledger names - Customer and vendor addresses - GST registration numbers - Invoice and voucher data - Bank-ledger names and transaction amounts - Stock, tax, and financial-year information No hostname allowlist, loopback check, HTTPS requirement, certificate validation policy, or destination confirmation is documented. Consequently, a misconfigured or attacker-controlled environment can redirect the Skill's accounting traf ...[truncated 1453 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:181

Finding

Mutable package release is installed globally without integrity verification

Content

View full analysis

= 1.1.0 ``` If missing or older: `npm install -g tallyca@latest` ``` ### Technical Analysis The fallback directs the agent to install the mutable `latest` release of `tallyca` globally. This creates several supply-chain risks: - `latest` can resolve to different code at different times. - No exact version or package integrity digest is verified. - npm installation may execute package lifecycle scripts. - Global installation changes the user's environment beyond the current Skill run. - A compromised maintainer account, package registry, or newly published release can alter the effective code after this Skill has been audited. Generating a PDF requires a suitable PDF tool, but automatically installing an unpinned package globally is not the minimum privilege needed to perform that operation. ### Attack Path 1. An attacker compromises the package, its publisher account, or the release process. 2. The attacker publishes a malicious version and assigns it the `latest` tag. 3. The Skill detects that `tallyca` is missing or older than the required version. 4. The agent follows the documented command: `npm install -g tallyca@latest`. 5. npm downloads the malicious release and may run its lifecycle scripts during installation. 6. The package executes with the privileges of the user running the agent and remains globally installed for future sessions. ### Impact Assessment A malicious package or lifecycle script can execute arbitrary commands with the invoking user's operating-system privileges. Depending on that user's access, it could read local files and environment variables, modify user-level applications or configuration, access accounting documents, or establish further compromise. The global installation ...[truncated 101 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:43

Finding

Incomplete XML escaping allows user-controlled values to alter Tally request structure

Content

View full analysis

UNIQUE_GUID YYYYMMDD Receipt NARRATION_TEXT No CUSTOMER_LEDGER BANK_OR_CASH_LEDGER Yes -AMOUNT CUSTOMER_LEDGER Yes No AMOUNT ``` ### Technical Analysis Escaping only `&` is insufficient for XML text and attribute contexts. At minimum, text inserted into XML must safely handle `<` and `&`; values used in attributes must also safely handle the corresponding quote character. The Skill also inserts dynamic data into many fields not covered by the stated rule, including: - Company names - Ledger and party names - Narration - Invoice numbers and references - Stock item and stock group names - Units and godown names - GST and address values - GUIDs, dates, quantities, rates, and amounts Some of this data can originate from user input, invoices, bank statements, or OCR output. Direct text subst ...[truncated 1500 chars]

Remediation

View remediation

` where appropriate. - Escape quotes correctly for attribute values. 4. Validate structured fields before serialization: - Dates must match exactly eight decimal digits in `YYYYMMDD` form. - Amounts, rates, and quantities must match strict numeric formats and valid ranges. - GSTINs must match the expected GSTIN format. - GUIDs and invoice identifiers must follow restricted character policies. 5. Treat OCR-derived text as untrusted input. 6. Reject control characters and unexpected markup in names, narration, addresses, and references. 7. Render the final accounting summary from parsed structured data rather than from the serialized XML. 8. Retain confirmation and post-entry verification as defense-in-depth, but do not rely on them as substitutes for safe XML construction. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 83% confidence

Finding

The instruction to auto-fill fields 'without asking the user' encourages autonomous decisions using parsed or fetched inventory data that may be incomplete, stale, or incorrectly inferred from naming conventions. In a financial/accounting context, silent inference of HSN, GST rate, or unit can produce incorrect invoices or tax treatment without the user realizing assumptions were made.

Content

Scanner excerpt · reference/inventory.md (reported line 7)May include surrounding context.

Fetch stock item details (unit + HSN + GST rate)

Use this before PDF generation to auto-fill unit, hsn-code, and gst-rate without asking the user.

xml

<?xml version="1.0" encoding="utf-8"?>

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a skill for posting purchase, sales, and bank entries in TallyPrime and generating sales invoice PDFs. This file instructs the skill to create additional inventory masters such as stock groups, units of measure, stock items, and godowns, which are master-data administration actions beyond merely posting entries or generating PDFs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs automatic creation of persistent inventory masters in Tally when an item is absent, but provides no requirement for explicit user confirmation before modifying accounting configuration. In an accounting system, unintended master creation can pollute books, create duplicate or incorrect inventory structures, and cause downstream posting/reporting errors.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Creating a godown alters persistent inventory configuration and can affect stock allocation, reporting, and future transactions, yet the guidance omits any warning or confirmation step. Because godown names and defaults may be inferred or created as part of workflow completion, users may unknowingly authorize lasting structural changes to their Tally environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented XML requests perform master-data creation in Tally by creating ledgers, which changes accounting configuration rather than merely reading data. Without an explicit warning or confirmation requirement, an agent or user may trigger persistent financial-data modifications unintentionally, leading to incorrect books, tax mapping errors, or audit issues.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · reference/reports.md (reported line 24)May include surrounding context.

Fetch last Sales invoice number (for auto-increment)

Use before PDF generation to determine the next invoice number without asking the user.

xml

<?xml version="1.0" encoding="utf-8"?>

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The manifest focuses on voucher posting and PDF generation, but this file adds a separate behavior to query stock item details and infer unit, HSN code, and GST rate automatically. While related to invoicing, it is still a broader inventory-intelligence capability not reflected in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill instructs retrieval of party GSTIN, address, and place-of-supply data from Tally and reuse of that information in generated invoices/PDF parameters, but does not clearly disclose this data flow. This can cause unintended exposure or processing of sensitive business and personal information, especially if users assume the step is limited to accounting automation rather than data extraction for document generation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The XML example sets <LANGUAGEID>1033</LANGUAGEID>, which implies an English locale, but the document does not explain the locale requirement or provide an option to use another language setting. This is a natural-language policy concern because it forces a locale-specific behavior without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.