Tally Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:41 AM UTC
• Version: 1.0.11

Overview

The skill mostly matches a TallyPrime accounting workflow, but it handles sensitive financial records and includes broad host-changing install instructions that deserve review before use.

Review before installing. Use only with a trusted, local TallyPrime endpoint, preferably localhost; do not point TALLY_URL at remote HTTP services unless an administrator has approved and secured it. Preinstall and pin tallyca and scribe through your normal admin process, avoid agent-run npm install -g or @latest upgrades, and prefer the pdfmake backend instead of sudo/Playwright setup on shared or production machines. Require explicit user approval and a backup/test company before any create, alter, cancel, master, inventory, or bulk bank-statement import operation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:16

Finding

Unrestricted TALLY_URL Can Redirect Sensitive Accounting Operations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16-30
Vulnerability Type: Server-side request redirection and sensitive data exposure
Risk Level: High

Vulnerable Code

yaml

requires:
  env:
    - TALLY_URL
metadata:
  openclaw:
    requiredEnv:
      - TALLY_URL
    bins:
      - curl
      - tallyca
      - scribe
    primaryCredential: TALLY_URL

markdown

Connect to a **locally running** TallyPrime instance via its **XML-over-HTTP** interface. All requests are HTTP POST to `$TALLY_URL` (commonly `http://localhost:9000`) with an XML body.

Technical Analysis

The Skill describes TallyPrime as a local service, but it does not require or validate that TALLY_URL resolves to a loopback address. The value is accepted from the environment and used as the destination for requests containing accounting data.

Report requests can expose vouchers, ledger names, balances, outstanding receivables and payables, GST information, company names, party identifiers, and addresses. Write requests can contain similarly sensitive data and can create, alter, or cancel accounting records.

Because the destination is unrestricted, a malicious or mistakenly configured environment can redirect these requests to an external server. Plain HTTP also provides no transport confidentiality or endpoint authentication when a non-loopback destination is used.

Attack Path

1. An attacker, compromised launcher, or unsafe deployment configuration sets TALLY_URL to an attacker-controlled HTTP endpoint.
2. The user asks the Skill to retrieve a financial report or post an accounting entry.
3. The Agent constructs an XML request containing company and accounting information.
4. The request is sent to the attacker-controlled endpoint instead of local TallyPrime.
5. The attacker captures the financial data and may return a forged Tally-like response to conceal the redirection.

This path ...[truncated 614 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse and validate TALLY_URL before every request.
2. Permit only localhost, 127.0.0.1, and IPv6 loopback by default.
3. Resolve hostnames and reject destinations that resolve to public, private LAN, link-local, multicast, or cloud metadata addresses unless remote access was explicitly authorized.
4. Restrict the port to the expected TallyPrime integration port or an explicit administrator-controlled allowlist.
5. Require explicit user or administrator approval before using any non-loopback endpoint.
6. Require HTTPS with certificate verification and authentication for approved remote Tally deployments.
7. Do not follow redirects to unapproved hosts.
8. Fail closed when URL parsing, hostname resolution, or endpoint validation is inconclusive.
9. Avoid logging complete XML bodies because they may contain financial and personal information.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:125

Finding

Mutable Global npm Package Installation Introduces Supply-Chain Code Execution Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 125-153
Vulnerability Type: Unpinned global third-party dependency installation
Risk Level: High

Vulnerable Code

bash

npm install -g tallyca

bash

npm install -g tallyca@latest

bash

npm install -g tallyca@1.0.1

bash

npm view tallyca version

markdown

If the registry version is newer **and** you want the latest fixes, run `npm install -g tallyca@latest`, then re-check `tallyca --version`.

Technical Analysis

The Skill instructs the Agent to install a third-party npm package globally and explicitly recommends the mutable latest release. The effective code can therefore change after the Skill has been audited.

npm packages can execute code through installation lifecycle scripts and subsequently through their command-line entry points. Global installation also exposes the package to other sessions and users of the same runtime environment. Although an exact-version alternative is documented, the automatic preflight workflow recommends @latest when the package is missing or outdated.

This is an unsafe dependency-management pattern rather than evidence that the named package is currently malicious.

Attack Path

1. The npm package, publisher account, transitive dependency, or registry delivery path is compromised.
2. A malicious release is assigned the latest tag.
3. A user requests PDF generation while tallyca is missing or considered outdated.
4. The Agent runs npm install -g tallyca@latest.
5. Malicious installation scripts execute, or the installed tallyca executable runs attacker-controlled code during document generation.
6. The payload operates with the permissions of the Agent process and remains available as a globally installed executable.

Impact Assessment

Exploitation could result in arbitrary code execution with the Agent's operating-system privileges. ...[truncated 384 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all use of @latest from automated or Agent-executed workflows.
2. Pin an audited exact package version and verify its registry integrity hash.
3. Maintain a reviewed lockfile for the package and all transitive dependencies.
4. Prefer a project-local installation or isolated container over global installation.
5. Disable npm lifecycle scripts where compatible, then explicitly install required runtime assets through a reviewed process.
6. Perform installation as a separate administrator-approved deployment step rather than during a user request.
7. Verify package provenance, publisher identity, signatures, and checksums before upgrades.
8. Require review and testing before changing the pinned version.
9. Run the PDF tool in a sandbox with limited filesystem and network access.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:180

Finding

Optional PDF Setup Requests Unnecessary Privileged System Modification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 180-196
Vulnerability Type: Excessive system privileges for optional PDF rendering dependencies
Risk Level: Medium

Vulnerable Code

bash

sudo yum install -y \
  alsa-lib atk at-spi2-atk cups-libs libdrm libXcomposite \
  libXdamage libXrandr mesa-libgbm pango gtk3
npx playwright install chromium
npx playwright install-deps chromium

bash

sudo apt-get update
sudo apt-get install -y \
  libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 \
  libxcomposite1 libxdamage1 libxrandr2 libgbm1 \
  libpango-1.0-0 libcairo2 libasound2 libatspi2.0-0
npx playwright install chromium
npx playwright install-deps chromium

Technical Analysis

The Skill provides commands that use sudo to modify operating-system packages and invokes npx playwright install-deps, which may also perform broad dependency installation. These changes are not necessary for the core accounting integration, and the same document states that the PDF tool supports a pure JavaScript pdfmake fallback.

Allowing an Agent to initiate privileged package installation violates least privilege when a non-privileged rendering path is available. The use of npx further introduces execution of package-provided tooling whose effective implementation is managed outside this reviewed project.

These commands are documented as optional rather than silently executed, but the instructions do not establish a mandatory explicit-approval boundary before elevation.

Attack Path

1. PDF rendering fails because Chromium or graphical libraries are unavailable.
2. The Agent follows the documented server setup instructions instead of selecting the non-privileged pdfmake backend.
3. The Agent or operator authorizes sudo package-manager execution.
4. System packages and browser dependencies are installed from configured repositories, and Playwright tooling executes locally.

...[truncated 827 chars]

Remediation

View remediation

Remediation Suggestions

1. Make TALLYCA_PDF_BACKEND=pdfmake the default on servers and restricted environments.
2. Remove sudo installation steps from instructions that the Agent may execute during a user task.
3. Require explicit, informed administrator approval before any operating-system package modification.
4. Perform browser and system dependency installation only during controlled image or container builds.
5. Use a pinned, reviewed container image when Chromium rendering is required.
6. Pin Playwright and browser versions and verify downloaded artifacts.
7. Run rendering in a sandbox without root privileges and with restricted filesystem and network access.
8. Fail safely and return a clear remediation message when neither the safe backend nor a pre-provisioned browser is available.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (26)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to run npm install -g tallyca@latest and related upgrade checks during normal task flow. Allowing a skill to perform global package installation from the network is dangerous because it expands privileges, changes host state, and introduces supply-chain risk from mutable external packages that are unrelated to the core Tally XML integration.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md

blish a newer **breaking** or **must-have** CLI release, **edit this line** in `SKILL.md` to the new minimum and redeploy the skill so agents reinstall if neede

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

md

blish a newer **breaking** or **must-have** CLI release, **edit this line** in `SKILL.md` to the new minimum and redeploy the skill so agents reinstall if neede

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 285)May include surrounding context.

md

blish a newer **breaking** or **must-have** CLI release, **edit this line** in `SKILL.md` to the new minimum and redeploy the skill so agents reinstall if neede

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill includes OS package installation, browser installation, and dependency bootstrap commands, including privileged package-manager usage, to support PDF rendering. This is far beyond the stated purpose of a local accounting connector and creates a significant attack surface by enabling host modification, privileged execution, and additional supply-chain exposure if the instructions are followed by an autonomous agent.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · reference/errors.md (reported line 21)May include surrounding context.

md

| Connection refused / timeout | TallyPrime not running or wrong port | Open TallyPrime; confirm port; check `$TALLY_URL` |
| Response doesn’t contain “Server is Running” | Wrong URL or Tally integration not enabled | Verify TallyPrime is running and integration is enabled |
| XML parser throws `ParseError` / "no element found" | Export Data responses are XML fragments (no single root) — this is by design | Use Python regex instead of `xml.etree.ElementTree`; see parsing guide in `reference/reports.md` |
| `curl ... > file` produces truncated or empty file | Shell redirect can silently truncate in compound commands | Use `curl --output /tmp/file.xml` (the `-o` flag) |
| `Could not find Report 'X'` | Wrong `REPORTNAME` | Use report names in `reference/reports.md`; if still failing, verify in TallyPrime Developer |
| `Could not find Collection 'X'` | Collection not available | Use custom TDL pattern (see `reference/reports.md`) |
| `Ledger 'X' does not exist` | Missing ledger master | Create ledger first (see `reference/masters.md`) |

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · reference/vouchers.md (reported line 50)May include surrounding context.

When CLASSNAME is set, always include all four GST header fields. Missing any one of them will cause Tally to reject the voucher or save it with incorrect GST treatment.

xml

<CLASSNAME>Purchase @ 18 %</CLASSNAME>   <!-- exact name as configured in Tally -->
<CMPGSTIN>COMPANY_GSTIN</CMPGSTIN>
<PARTYGSTIN>PARTY_GSTIN</PARTYGSTIN>
<GSTREGISTRATIONTYPE>Regular</GSTREGISTRATIONTYPE>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · reference/vouchers.md (reported line 394)May include surrounding context.

md

</BILLALLOCATIONS.LIST>
            </LEDGERENTRIES.LIST>

            <!-- Purchase / expense ledger -->
            <LEDGERENTRIES.LIST>
              <LEDGERNAME>PURCHASE_LEDGER</LEDGERNAME>
              <ISDEEMEDPOSITIVE>Yes</ISDEEMEDPOSITIVE>

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill says to use it whenever the user mentions broad terms like 'Tally,' 'invoices/bills,' 'outstanding,' 'GST,' or 'financial statements.' These are common phrases in ordinary accounting discussions, and the file does not provide exclusion conditions or narrower trigger constraints, which could cause unintended invocation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest frames the skill as a CA interface for reading reports and posting/updating vouchers in TallyPrime via local XML-over-HTTP. However, the documentation adds substantial non-Tally functionality: mandatory OCR/data extraction from uploaded PDFs/images using scribe, and later generic PDF generation from arbitrary text using tallyca. These are meaningful end-user capabilities, not just incidental implementation details of HTTP-based Tally operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest presents a local Tally integration, but the documented workflow also directs the agent to access npm and install or upgrade packages from the network. This materially changes the trust and execution boundary: a skill that appears local-only can trigger external package retrieval and system modification, increasing supply-chain and unauthorized change risk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill documents sudo yum install for runtime support tasks, encouraging privileged system modification from within a skill context. In an agentic environment, instructions that require root elevate the blast radius dramatically: they can alter the host, install arbitrary packages, and normalize unsafe privilege use for tasks unrelated to accounting entry operations.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

Amazon Linux 2 / AL2023

bash

sudo yum install -y \
  alsa-lib atk at-spi2-atk cups-libs libdrm libXcomposite \
  libXdamage libXrandr mesa-libgbm pango gtk3
npx playwright install chromium

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The sudo apt-get update instruction requires root-level execution and changes system package state, which is inappropriate for a business-document/accounting skill. If an agent follows such guidance, it can perform unauthorized privileged operations and open the door to broader host compromise through package management pathways.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

Ubuntu / Debian

bash

sudo apt-get update
sudo apt-get install -y \
  libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 \
  libxcomposite1 libxdamage1 libxrandr2 libgbm1 \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The sudo apt-get install command explicitly directs privileged package installation on the host. This is dangerous because it expands the skill from a local application integration into system administration with root privileges, increasing the consequences of misuse, prompt injection, or operator over-trust.

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

bash

sudo apt-get update
sudo apt-get install -y \
  libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 \
  libxcomposite1 libxdamage1 libxrandr2 libgbm1 \
  libpango-1.0-0 libcairo2 libasound2 libatspi2.0-0

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file provides ready-to-use XML payloads that create stock groups, units, stock items, godowns, and sales invoices directly in TallyPrime, but it does not clearly warn that these are state-changing operations affecting accounting and inventory records. In a skill designed to operate against a local accounting system, omission of explicit cautions and confirmation requirements increases the risk of accidental or unauthorized data modification, including incorrect inventory masters and posted vouchers.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file materially expands capability from report reading and voucher posting/updating into master creation and alteration, which are separate high-impact administrative operations. In an agent setting, this scope drift increases the chance the assistant performs destructive or unauthorized accounting changes that users and policy layers did not expect from the declared skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document provides import templates that write directly to Tally masters but does not prominently warn that these actions modify live accounting data. In a local XML-over-HTTP integration, omission of a clear mutation warning makes accidental data changes more likely, especially when operators may mistake examples for safe read-only operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The new-company setup section introduces a bulk administrative workflow that creates multiple GST-related ledgers, exceeding the stated report/voucher scope and enabling broad modification of accounting configuration. Because it says to run all seven blocks in order, an agent could make sweeping changes to a live company with a single misunderstood request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction to run all seven blocks for new company setup encourages bulk creation of multiple ledgers without clearly warning about the cumulative effect on the target company. This can lead to unintended configuration changes, duplicate ledgers, or incorrect tax setup if applied to the wrong company or without validating existing masters.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document provides ready-to-use templates for exporting highly sensitive accounting, tax, ledger, voucher, and company data over local HTTP, but it does not warn about confidentiality, access control, or the risk of exposing financial records to other local users, malware, proxies, logs, or misconfigured network bindings. In this skill context, the omission is more dangerous because the skill is explicitly designed for CA workflows and handles regulated financial data, so users may invoke broad exports without understanding the privacy and compliance implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file documents ACTION="Cancel" for vouchers without requiring an explicit confirmation or warning about irreversible accounting impact. In an agentic context, destructive operations on financial records can be triggered too easily, causing data loss, audit issues, or fraudulent tampering if a prompt or upstream instruction causes unintended cancellation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.