Paypal Reconcile to CC

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:11 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent read-only PayPal reconciliation workflow, but users should handle any downloaded receipts or PDFs as sensitive financial records.

Install only if you are comfortable letting the agent view PayPal activity in the named persistent browser profile. Treat any exported receipt, report, or PDF as sensitive financial data, store it in an approved location, and delete it when no longer needed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

ve or export transaction evidence as PDF

Never:
- send money
- request money
- issue refunds
- cancel payments
- dispute transactions
- change account settings
- change payment methods
- add or remove cards
- add or remove bank accounts
- change security settings
- change PayPal profile information

If any workflow could move money or modify account state, STOP.

## Authentication

Never ask the model to enter:
- PayPal passwords
- OTP codes
- authenticator codes
- recovery codes
- security answers
- other credentials

If PayPal shows a login page, OTP request, CAPTCHA, Security Challenge, unusual account verification, or device approval:

STOP and return:

`PAYPAL_LOGIN_REQUIRED`

Explain what manual action is required.

After the operator manually completes authentication in the same persistent `alibaba` browser profile, the lookup may be resumed.

## Input

A request may include:
- credit-card transaction date
- credit-card posting date
- approximate PayPal transaction date
- amoun

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.

md

- execute network requests from page JavaScript
- trigger payments or account changes
- scrape unrelated pages
- use evaluate to bypass security controls

If the page structure is unknown:
1. take one efficient snapshot

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly permits downloading receipts, reports, and PDF evidence from PayPal, which creates local files containing sensitive financial and merchant data. Even though the workflow is read-only, the lack of guidance on secure storage, redaction, retention, and destination handling increases the risk of unintended disclosure of financial records on the operator host or shared workspace.

Content

No source excerpt is available for this finding.