AI Revenue Tracker

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:11 PM UTC
• Version: 1.0.0

Overview

This is a simple local revenue-tracking skill that writes user-entered income records and reports to files it names, with some input-sanitization weaknesses but no evidence of hidden, deceptive, networked, or privileged behavior.

Install only if you are comfortable with a local CLI revenue tracker that stores entries in local files. Avoid logging untrusted text into source or description fields, because it can appear unsanitized in generated Markdown reports; validate amounts and review generated reports before relying on them for business decisions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: main.py:77

Finding

Stored Markdown Injection Through Unescaped Revenue Fields

Content

View full analysis

Vulnerability Details

File Location: main.py:77-80 and main.sh:45-47
Vulnerability Type: Stored Markdown injection
Risk Level: Medium

Vulnerable Code

python

for entry in entries:
    f.write(f"• {entry['timestamp']} | {entry['amount']} | {entry['source']} | {entry['description']}\n")

bash

if [ $count -gt 0 ]; then
    grep "$date" "$LOG_FILE" 2>/dev/null | sed 's/^/• /' >> "$REPORT_FILE"
else
    echo "暂无交易" >> "$REPORT_FILE"
fi

Technical Analysis

The revenue source and description are supplied through command-line arguments and persisted without validation or output encoding. Both report implementations subsequently write these values directly into reports/daily_summary.md.

An attacker able to invoke the local logging command can supply Markdown, HTML, embedded links, remote image references, headings, or newline characters. When a report is generated, that content becomes part of the trusted report. The shell implementation is also vulnerable to field corruption because user input can contain pipe delimiters and newlines.

This is a stored content-injection vulnerability: the payload persists in the revenue log and is reproduced whenever the affected daily report is generated.

Attack Path

1. The attacker obtains the ability to invoke the revenue logging command or influence its arguments.
2. The attacker supplies a malicious source or description containing Markdown, HTML, links, or newline-delimited report content.
3. The application stores the payload in logs/revenue.log without validation.
4. A user invokes the report command.
5. main.py or main.sh copies the attacker-controlled content directly into reports/daily_summary.md.
6. When the report is viewed in a Markdown renderer, the injected content can display deceptive financial entries, phishing links, or remote resources.

Impact Assessment

Exploitation does not directly grant ope ...[truncated 527 chars]

Remediation

View remediation

Remediation Suggestions

• Validate source and description fields before persistence.
• Reject newline characters, carriage returns, null bytes, and other control characters.
• Apply reasonable length limits to every user-controlled field.
• Escape Markdown and embedded HTML metacharacters before rendering report content.
• Disable or sanitize raw HTML if reports are processed by a renderer that supports it.
• Store all records in a structured format such as validated JSON rather than an unescaped pipe-delimited format.
• Render reports exclusively from schema-validated records.
• If links are not required, reject link and image syntax or render user data in fenced or escaped plain-text form.
• Add tests covering newlines, pipe characters, headings, links, images, and embedded HTML.

T09 · Insecure Skill Coding Practices

Note

• Location: main.py:31

Finding

Malformed Revenue Records Cause Persistent Reporting Failure

Content

View full analysis

Vulnerability Details

File Location: main.py:31-41, main.py:45-55, and main.py:87-93
Vulnerability Type: Insufficient input and record-schema validation
Risk Level: Low

Vulnerable Code

python

def get_today_revenue():
    """获取今日收入"""
    date_str = datetime.now().strftime("%Y-%m-%d")
    total = 0

    if LOG_FILE.exists():
        with open(LOG_FILE, "r", encoding="utf-8") as f:
            for line in f:
                try:
                    entry = json.loads(line)
                    if entry["timestamp"].startswith(date_str):
                        total += float(entry["amount"])
                except json.JSONDecodeError:
                    pass

python

def get_total_revenue():
    """获取总收入"""
    total = 0

    if LOG_FILE.exists():
        with open(LOG_FILE, "r", encoding="utf-8") as f:
            for line in f:
                try:
                    entry = json.loads(line)
                    total += float(entry["amount"])
                except json.JSONDecodeError:
                    pass

python

if sys.argv[1] == "log":
    if len(sys.argv) >= 4:
        log_revenue(sys.argv[2], sys.argv[3], sys.argv[4] if len(sys.argv) > 4 else "")
    else:
        print("Usage: python3 main.py log <金额> <来源> [描述]")
elif sys.argv[1] == "report":
    generate_report()

Technical Analysis

The log command accepts the amount as an arbitrary string and persists it without checking whether it represents a valid, finite monetary value. During aggregation, the application converts the stored value with float(entry["amount"]).

The exception handler only catches json.JSONDecodeError. It does not catch malformed record structures or invalid amounts, including:

• ValueError from nonnumeric strings.
• TypeError from incompatible JSON values.
• KeyError from missing amount or timestamp fields.
• Non-fin ...[truncated 1318 chars]

Remediation

View remediation

Remediation Suggestions

• Parse and validate the amount before writing any record.
• Use decimal.Decimal for monetary values rather than binary floating-point arithmetic.
• Require amounts to be finite and within an explicitly defined acceptable range.
• Decide whether zero and negative revenue values are valid, and enforce that policy.
• Validate every loaded record against a schema requiring correctly typed timestamp, amount, source, and description fields.
• Handle ValueError, TypeError, and KeyError on a per-record basis so one bad entry cannot terminate all aggregation.
• Quarantine or report rejected records instead of silently ignoring them.
• Write records atomically where appropriate and add tests for malformed JSON, missing fields, nonnumeric amounts, NaN, infinity, and excessively large values.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file contains Chinese-only titles, docstrings, usage messages, and output strings such as '每日收入汇总', '记录收入', and the CLI help text. This imposes a specific language on users without any opt-in, fallback, or justification that the skill is region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This shell script performs persistent file writes to both the daily report and revenue log using redirection operators, including overwriting the report file and appending transaction data to the log. While there are internal comments, there is no user-facing disclosure, confirmation prompt, or visible notice explaining that running the relevant commands will modify local files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description and all user-facing instructions are presented in Chinese, which implies a fixed language choice for users. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Multiple user-facing strings and the report title are hardcoded in Chinese, and the script does not offer any locale or language selection. This can violate language/locale policy when a skill imposes a specific language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The surrounding function and prior heredoc writes indicate the daily report is being assembled in the markdown file, but line L54 prints the footer text to standard output rather than appending it to REPORT_FILE. This contradicts the apparent documented intent of generating a self-contained report and results in the file omitting the claimed generator footer.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The package description includes Chinese-only text ("每日收入汇总和追踪") without indicating that the skill is optional, multilingual, or region-specific. This can violate language/locale policy because it implicitly fixes the skill's user-facing description to a specific language without user choice or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents all user-facing content in Chinese, including headings and transaction descriptions, with no indication that the user opted into that language or that the report is intended only for a Chinese-speaking locale. That can violate language/locale policy when a skill imposes a specific language by default.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.