Wallet (By Budgetbakers)

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:59 PM UTC
• Version: 0.0.1

Overview

This skill is a straightforward read-only helper for a personal finance API, but users should handle the API token and returned financial data carefully.

Install only if you intend to let an agent query your BudgetBakers Wallet data. Keep WALLET_API_TOKEN in a protected environment variable, do not paste it into prompts or logs, and ask for narrow date ranges or limits when retrieving transactions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill invokes shell commands and instructs users to set and use an API token, but it does not declare an explicit tool scope such as allowed-tools or permissions. In an agent environment, undeclared shell capability weakens policy enforcement and can allow broader-than-expected command execution paths, especially when handling sensitive finance data and secrets.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This skill is designed to access highly sensitive personal financial information and requires an API token, yet it does not prominently warn users about the exposure risks of account, transaction, budget, and template data. In practice, this can lead users or downstream agents to request, print, log, or mishandle sensitive financial records and credentials without appropriate caution.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly enables access to highly sensitive personal finance data using a bearer token, but it does not warn that the token grants direct account access or instruct users to protect, rotate, and avoid exposing it. In an agent-skill context, this omission is more dangerous because agents may log, echo, mishandle, or over-request financial data unless the docs clearly establish safe handling expectations.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This shell script performs HTTP requests to a wallet service using the user's bearer token, which may expose personal financial account and transaction data to a remote system. While the script documents how to set the token, it does not provide a user-facing warning, confirmation, or explicit disclosure that commands send authenticated financial data over the network.

Static analysis

No suspicious patterns detected.