other
Warning
- Location
references/session-scan.md:23- Finding
Overbroad Discovery and Collection of Local AI Session History
- Content
View full analysis
- Remediation
View remediation
Security audit
Moneyprinter
Security checks for vulnerabilities and agentic risk
Overview
This skill is not malicious, but it asks to broadly scan and correlate recent local AI session history for revenue advice, which deserves Review before installation.
Install only if you are comfortable granting explicit, narrowly scoped access to recent local AI session history. Before using it, limit sources and projects, exclude sensitive legal, medical, financial, customer, employee, credential, and unrelated work, and require fresh approval before any scan or external action.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md name, apply that skill's checked-in `SKILL.md` workflow and required references
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file defines a workflow to scan and read 14 days of retained AI session history across the host, which is materially unrelated to the MoneyPrinter skill's stated purpose of revenue and monetization advice. That mismatch creates unjustified access to sensitive historical data and expands the skill's effective privileges far beyond user expectations, increasing privacy and prompt-injection risk.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instructions direct the agent to discover every detectable session store on the current host and inspect retained history from local AI tools, IDEs, wrappers, and harnesses. Even with some exclusions, this is an overbroad data-collection behavior unrelated to revenue coaching and can expose confidential conversations, business plans, credentials-adjacent data, and sensitive cross-tool context.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The markdown instructs reading every qualifying accessible session, including child sessions, branches, goal state, and task/completion state, and to batch through all history deterministically. This mandates exhaustive collection rather than least-privilege sampling, enabling large-scale exposure of sensitive historical data with little connection to the skill's declared business-advice function.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description uses very broad trigger phrases like 'how to make money' and 'grow revenue', which are common in ordinary conversation and can cause unintended invocation. In this skill, accidental activation is more dangerous than usual because the workflow drives inspection of 14 days of accessible AI session history, increasing the chance of unnecessary exposure of sensitive user data and over-broad autonomous behavior.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 84% confidence
- Finding
The skill authorizes reuse of a prior permission grant found in the conversation 'without asking again' to inspect 14 days of accessible CLI and GUI session history. Even though it requires explicit permission at some point, reusing old consent for broad, privacy-sensitive scanning creates a meaningful risk of stale, misunderstood, or overly broad authorization, especially given the sensitivity of chat histories and work artifacts.
- Content
md and `references/session-scan.md`. 2. First check the current conversation for an adequate explicit permission grant to inspect the rolling 14 days of accessible AI CLI and GUI session history. If one exists, record its scope and exclusions and use it without asking again. Otherwise, ask once and let the user narrow or exclude sources. Never infer scan permission from historical sessions, old summaries, silence, or invocation of MoneyPrinter alone.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md First check the current conversation for an adequate explicit permission grant to inspect the rolling 14-day window of accessible AI CLI and GUI session history. If one exists, record its scope and exclusions and use it without asking again. Otherwise, ask once and let the user narrow or exclude sources. Never infer scan permission from historical sessions, old summaries, silence, or invocation of MoneyPrinter alone. If permission is denied or narrowed,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Although the file mentions permission and excludes some protected stores, it does not clearly foreground the privacy consequences of scanning retained AI histories across multiple local tools and stores. Users may not understand that old conversations can contain highly sensitive commercial, personal, legal, or regulated information, so consent may be insufficiently informed.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The portfolio extraction section instructs the agent to merge projects and goals across hosts into a unified source-linked profile using historical evidence. This creates cross-context aggregation of sensitive personal and business information, which can reveal more than any single source and exceeds what is reasonably necessary for ordinary monetization guidance.
- Content
Static analysis
No suspicious patterns detected.