Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly does what it claims, but its local-only financial report has under-disclosed privacy and HTML-safety risks that need review before installation.
Review this skill before installing. It handles private financial data and saves reports locally, which is disclosed, but the generated report can contact Google Fonts despite the no-network claim and the template does not define safe escaping for merchant or transaction text. Use only with trusted input or after fixing the template to remove external resources, add a restrictive content policy, and require HTML escaping for all generated report values.
assets/template.html:394External Google Fonts Request Violates the Local-Only Privacy Guarantee
assets/template.html:443Unescaped Raw HTML Report Placeholders Enable Stored HTML or Script Injection
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
</style>
</head>
<body>
<!-- HEADER CARD -->
<div class="header-card">
<p class="scope">{{TRANSACTION_COUNT}} transactions · {{CURRENCY}}</p>
<h1 class="month-title">{{MONTH_DISPLAY}}</h1>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<button class="control-btn" onclick="expandAll()">Expand All</button>
</div>
<!-- ALERTS SECTION -->
<div class="alerts-section {{ALERTS_EMPTY_CLASS}}" id="alerts-section">
<div class="section-header" onclick="this.parentElement.classList.toggle('collapsed')">
<span class="section-title">⚠️ Alerts</span>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
</div>
</div>
-->
<!-- TEMPLATE: Category Card without Budget
<div class="category-card">
<div class="category-header">
<span class="category-name">Category Name</span>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
</div>
</div>
<!-- TOP MERCHANTS SECTION -->
<div class="section" id="merchants-section">
<div class="section-header" onclick="this.parentElement.classList.toggle('collapsed')">
<span class="section-title">🏪 Top Merchants</span>
The trigger list is very broad and matches common, natural-language budgeting requests, increasing the chance the skill activates when a user did not explicitly intend to invoke this specific tool. Because the skill processes sensitive financial data and writes persistent local state and reports, unintended activation can expose or retain private transaction information without clear user intent.
The skill generates and persists HTML and JSON reports plus state files containing transaction history, merchant data, budgets, and spending patterns under the user's home directory. Even though storage is local-only, this is still sensitive financial information retained across sessions, which increases exposure if the device, account, or files are accessed by another local user, backup system, or unrelated tooling.
### 6. Generate HTML Report
Create local HTML file with:
- Month summary (income, expenses, net)
- Category breakdown with budget status
- Top merchants
The documented reset-state command is destructive, but the skill description and surrounding guidance do not prominently warn that it can erase budgets, merchant overrides, and history. A user or calling agent could invoke it without understanding the data-loss consequence, leading to irreversible loss of financial tracking state.
The template imports Google Fonts from an external domain, which causes the user's browser to make a network request when rendering a local financial report. In the context of a bank transaction analysis skill, this leaks metadata such as IP address, user agent, timing, and report access to a third party, undermining the expectation of a local/private workflow.
The copySummary function copies sensitive financial summary data to the system clipboard without any warning, confirmation, or indication of downstream exposure risk. Clipboard contents may be read by other applications, pasted into the wrong destination, or persist beyond the user's intent, which is especially sensitive for banking and budget data.
The HTML root sets lang="en", which fixes the document language to English with no indication of user selection or locale configurability. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is documented and justified.
No suspicious patterns detected.