Finml Toolkit

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:10 AM UTC
• Version: 1.0.0

Overview

The skill is a local financial-ML logging tool, but it is packaged and implemented inconsistently and can retain sensitive user-entered financial details in plaintext logs.

Review this before installing. Use it only if you intentionally want a local audit log of financial ML workflow text, and avoid entering credentials, account identifiers, private strategy details, or regulated data. The package should be fixed to align its description with its behavior, honor the documented data-directory setting, enforce private permissions, and provide deletion or retention controls.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:5

Finding

Persistent Financial Operation Logs Are Created Without Restrictive Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh:5-8; input-writing branches at scripts/script.sh:126-305
Vulnerability Type: Plaintext sensitive-data storage with permissions inherited from the caller's umask
Risk Level: Medium

Vulnerable Code

bash

DATA_DIR="${HOME}/.local/share/finml-toolkit"
mkdir -p "$DATA_DIR"

_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

Representative persistent input storage:

bash

run)
    shift
    if [ $# -eq 0 ]; then
        echo "Recent run entries:"
        tail -20 "$DATA_DIR/run.log" 2>/dev/null || echo "  No entries yet. Use: finml-toolkit run <input>"
    else
        local input="$*"
        local ts=$(date '+%Y-%m-%d %H:%M')
        echo "$ts|$input" >> "$DATA_DIR/run.log"
        local total=$(wc -l < "$DATA_DIR/run.log")
        echo "  [Finml Toolkit] run: $input"
        echo "  Saved. Total run entries: $total"
        _log "run" "$input"
    fi
    ;;

The same storage pattern is repeated for the check, convert, analyze, generate, preview, batch, compare, export, config, status, and report commands.

Technical Analysis

The script persistently records arbitrary user input in plaintext log files under ~/.local/share/finml-toolkit. It creates the data directory with mkdir -p and creates log files through shell redirection, but it does not establish a restrictive umask or explicitly enforce directory and file permissions.

Consequently, permissions depend on the invoking process's environment. With a common 022 umask, a newly created directory may have mode 0755 and log files may have mode 0644. If the user's home-directory traversal permissions permit access, other local accounts could read these files.

This is particularly relevant because the documented use cases include financial strategy descriptions, portfolio verification, configuration records, and financial-processing reports. Use ...[truncated 1436 chars]

Remediation

View remediation

Remediation Suggestions

1. Establish a restrictive umask before creating any persistent storage:

bash

umask 077

2. Create and enforce a private data directory:

bash

DATA_DIR="${FINML_TOOLKIT_DIR:-${HOME}/.local/share/finml-toolkit}"
mkdir -p -m 700 -- "$DATA_DIR"
chmod 700 -- "$DATA_DIR"

3. Ensure every existing or newly created log and export file is owner-readable and owner-writable only:

bash

touch -- "$DATA_DIR/history.log"
chmod 600 -- "$DATA_DIR/history.log"

Apply equivalent permission enforcement to command-specific logs and generated export files.

4. Validate that a configured data directory is owned by the current user and is not an unsafe symbolic link before writing to it.

5. Document that users must not place passwords, API tokens, private keys, or other credentials in log-command arguments.

6. Consider optional redaction of common secret formats and provide a retention or secure-deletion mechanism for sensitive historical records.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill metadata advertises a curated financial ML resource, but the documented behavior is a generic local logging and export utility that persistently stores arbitrary user input. This mismatch is dangerous because users may invoke the skill under false assumptions, causing unintended collection and retention of sensitive prompts, operational details, or financial data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script presents itself as a financial machine learning tool, but the implemented behavior is a generic local logging utility with no connection to the stated purpose. This kind of capability mismatch is dangerous because it can mislead users into providing data under false expectations, increasing the likelihood of unnecessary collection and retention of potentially sensitive inputs.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest claims one purpose while the skill body describes a Bash audit/logging toolkit that writes command history and export files locally. Such semantic deception increases the risk of covert data capture because operators expecting informational content may instead provide inputs that are stored and later searchable/exportable.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The command set uses highly generic triggers such as run, check, analyze, generate, export, config, status, and report, which overlap with common language and common agent actions. In an agent environment, this broad trigger surface can cause accidental invocation and unintended logging of unrelated user content into persistent local files.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script immediately creates a persistent data directory and history log infrastructure despite the skill description not justifying long-term storage. Unnecessary persistence expands privacy and security exposure because user-provided content may remain on disk indefinitely and be accessed by other local processes or users depending on system configuration.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The help text advertises export functionality, but the first 'export' case in the dispatcher only records user input and prevents the real exporter function from being reached. This deceptive control flow can trick users into believing data is being exported while the tool instead captures and stores supplied arguments, which is especially concerning when users may pass sensitive dataset names or destinations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The help text claims 'status' performs a health check, but the first 'status' branch only logs user input and makes the real status implementation unreachable. Misleading users about operational behavior undermines trust and can facilitate covert data capture of arguments entered for diagnostics or environment inspection.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Across many commands, arbitrary user input is written verbatim into per-command logs and a shared history log without validation, minimization, or clear business need. In a finance-related context, users may enter trading ideas, credentials, account identifiers, or proprietary research, so broad retention materially increases confidentiality and privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code persistently writes user-supplied input to local logs without upfront disclosure or consent. Silent retention is risky because users interacting with a purported financial ML tool may provide sensitive or regulated information that is then stored on disk unexpectedly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.