Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local, read-only helper for analyzing Copilot Money data, with sensitive access that matches its stated purpose.
Install only if you are comfortable letting the agent read and summarize your local Copilot Money financial records. Prefer specific questions and avoid asking it to dump raw database or cache contents unless you really need that detail.
The skill is designed to access and analyze highly sensitive financial records, including transactions, balances, budgets, and investments, but provides no privacy disclosure, consent guidance, or data-handling limitations. This increases the risk of over-collection, unintended exposure, or analysis of sensitive information without clear user awareness or minimization boundaries.
The skill explicitly instructs use of shell pipelines (strings, grep, sort) against local Firestore LevelDB files, which expands the skill from structured finance queries into arbitrary file-scanning and subprocess-style data extraction. In a skill handling personal finance data, this is dangerous because it normalizes unstructured scraping of highly sensitive local data stores and can expose more information than needed for the user’s request.
No suspicious patterns detected.
