Moneyprinter

• Outcome: Review
• Latest audit: Jul 20, 2026 · 2:46 AM UTC
• Version: 1.0.1

Overview

The skill is coherent and not malicious, but it asks an agent to broadly inspect recent local AI session histories, which is sensitive enough that users should review the scope before installing.

Install only if you are comfortable letting the agent inspect recent AI session history across detected local tools. Before use, give a narrow permission statement naming the sources allowed or excluded, and do not approve external actions unless the exact channel, audience, message, account, cost, and timing are shown.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly directs discovery and reading of retained AI session history across local CLI, GUI, IDE, and agent-harness stores, which can expose highly sensitive personal, business, and security-relevant data. Although it mentions checking for permission, it lacks a strong user-facing privacy warning and normalizes broad cross-application history inspection, making over-collection and accidental privacy invasion more likely.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

and `references/session-scan.md`.
2. First check the current conversation for an adequate explicit permission
   grant to inspect the rolling 14 days of accessible AI CLI and GUI session
   history. If one exists, record its scope and exclusions and use it without
   asking again. Otherwise, ask once and let the user narrow or exclude sources.
   Never infer scan permission from historical sessions, old summaries,
   silence, or invocation of MoneyPrinter alone.

• Confidence: 90% confidence
• Finding: The skill allows reuse of a prior permission grant in the current conversation to inspect the user's last 14 days of accessible AI CLI and GUI session history without re-prompting at execution time. Even though it forbids inferring permission from silence or old summaries, this still enables autonomous access to potentially sensitive local history stores and creates a meaningful privacy and over-collection risk if the prior consent was ambiguous, stale within the conversation, or broader than the user intended.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

First check the current conversation for an adequate explicit permission grant
to inspect the rolling 14-day window of accessible AI CLI and GUI session
history. If one exists, record its scope and exclusions and use it without
asking again. Otherwise, ask once and let the user narrow or exclude sources.
Never infer scan permission from historical sessions, old summaries, silence,
or invocation of MoneyPrinter alone. If permission is denied or narrowed,

• Confidence: 78% confidence
• Finding: The workflow authorizes the agent to decide that prior conversation text constitutes sufficient permission and then proceed 'without asking again.' That creates a risk of the agent making a consequential privacy decision from ambiguous context, leading to unauthorized inspection of session history if consent was misunderstood or stale.

Static analysis

No suspicious patterns detected.