Security audit

账本

Security checks across malware telemetry and agentic risk

Overview

This bookkeeping skill is purpose-aligned, but it handles sensitive financial records and credentials with under-scoped authentication and write-operation safeguards.

Review before installing. Use the user-provided token path if possible, avoid the MAC-derived API identity path unless you accept device-linked identification, and require your agent to show and confirm all financial write operations before submitting them. Treat the saved token and any identity ID as sensitive credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to fingerprint the host by collecting the MAC address, deriving a stable identity, and using it to mint authentication tokens automatically. For a personal bookkeeping skill, this exceeds expected data access, creates device-tracking and unauthorized credential-generation risk, and could expose host-level identifiers to an external service without clear necessity or consent.

Context-Inappropriate Capability

Low

Confidence: 83% confidence
Finding: The document instructs persistent storage of authentication material in memory, including tokens and in one path a long-lived identity ID, expanding the skill from bookkeeping into credential handling. Persisting secrets without scoping, lifecycle controls, or protection guidance increases the chance of credential leakage, replay, or unintended reuse across sessions.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger description is broad and overlaps with common everyday phrases such as '记账', '账本', '查收支', and '财富看板', which can cause the skill to activate in contexts where the user did not intend to perform a financial operation. Because this skill handles sensitive personal finance actions and can lead to authenticated bookkeeping or asset/liability changes, accidental invocation increases the risk of unintended data access or transaction recording.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The auth flow tells the agent to collect a device MAC-derived identifier, contact a remote API, and persist both the resulting token and identity material, yet it does not require an explicit privacy/security disclosure to the user. In a finance-related skill handling sensitive account data, silent collection and retention of device-linked identifiers materially raises privacy, consent, and account-access risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This documentation exposes multiple write-capable financial operations such as income, expense, buy/sell asset, borrow, and repay, but does not clearly require explicit user confirmation or warn that these actions modify real financial records and positions. In the context of a personal finance skill, an agent could translate ambiguous user language into irreversible or harmful bookkeeping and asset-management actions, causing incorrect records, liability changes, or unintended portfolio transactions.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The example code sends a bearer token and detailed tool arguments to a remote endpoint handling personal financial data, but provides no warning about transmitting sensitive credentials and financial information off-platform. This increases the risk of careless deployment, token leakage, or unreviewed data sharing with a third-party service, especially by downstream integrators who may copy the sample as-is.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.