Paypal Reconcile to CC

• Outcome: Pass
• Latest audit: Aug 22, 2026 · 11:22 AM UTC
• Version: 1.0.0

Overview

This skill is a clearly scoped, read-only PayPal reconciliation helper, though it handles sensitive transaction data and may save local evidence files.

Install only if you intend the agent to use an existing authenticated PayPal browser profile for read-only reconciliation. Expect it to view transaction history and potentially save receipt/report PDFs containing sensitive financial details; review where your browser downloads files and keep those documents protected.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This markdown file applies to SQP-2, and it explicitly authorizes downloading reports/receipts and saving evidence as PDF. While the document emphasizes read-only behavior, it does not clearly warn the user that these actions create local files containing potentially sensitive transaction information.

Instruction Override

High

• Category: Prompt Injection

Content

- execute network requests from page JavaScript
- trigger payments or account changes
- scrape unrelated pages
- use evaluate to bypass security controls

If the page structure is unknown:
1. take one efficient snapshot

• Confidence: 90% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

## Authentication

Never ask the model to enter:
- PayPal passwords
- OTP codes
- authenticator codes

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Static analysis

No suspicious patterns detected.