Security audit

Bank Recon Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill locally reconciles user-provided bank and ledger files and creates Excel reports, with some ordinary handling risks for sensitive financial files.

Install only if you are comfortable letting the skill read the specific bank statement and GL files you provide and write reconciliation workbooks containing financial data. Use trusted, reasonably sized PDFs/XLSX files, choose a private output folder, and remember that PDF input creates an additional _extracted.xlsx file beside the PDF.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/recon_logic.py:18
Finding: Unbounded XLSX Decompression and XML Parsing Can Cause Resource Exhaustion
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/recon_logic.py:39
Finding: Unbounded PDF Stream Decompression Can Cause Resource Exhaustion
Content: View full analysis
>\s*stream\n(.*?)~>endstream', re.S) for m in pattern.finditer(pdf): data = m.group(2) + b'~>' try: dec = base64.a85decode(data, adobe=True) out = zlib.decompress(dec).decode('latin1', 'ignore') decoded.append(out) except Exception: continue return decoded ``` ### Technical Analysis The function loads the complete PDF into memory with `Path.read_bytes()`. It then uses a whole-file regular expression with a broad `.*?` component and decodes every matching stream into additional in-memory buffers. Most importantly, `zlib.decompress()` is called without an output-size limit. An attacker-controlled Flate stream can have a very high expansion ratio, causing a small encoded stream to produce a large decompressed result. The encoded data, ASCII85-decoded bytes, decompressed bytes, decoded string, and entries retained in `decoded` may coexist in memory. Multiple matching streams can increase cumulative consumption. Malformed content is silently ignored, but the broad exception handler does not protect against prior excessive memory or CPU consumption. ### Attack Path 1. An attacker creates a PDF containing one or more ASCII85/Flate streams with a very high decompression ratio. 2. The PDF is supplied as the bank statement input. 3. `decode_pdf_streams()` loads the entire file and locates the crafted streams. 4. `base64.a85decode()` creates an intermediate decoded buffer. 5. `zlib.decompress()` expands the malicious stream without an output cap. 6. Expanded st ...[truncated 644 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
md
5. Run `scripts/recon_logic.py` with the bank file, GL file, output file, and threshold.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
5. Run `scripts/recon_logic.py` with the bank file, GL file, output file, and threshold.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill can read user-supplied files and drive a reconciliation workflow, but it declares no explicit tool scope or permissions boundary. That creates an authorization ambiguity where an orchestrator may invoke the skill for file access without clear user-visible constraints, increasing the chance of unintended file reads or broader-than-expected data handling.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The description is broad enough to match many generic file-processing or spreadsheet-analysis requests, which can cause the skill to trigger in contexts beyond narrowly intended bank reconciliation tasks. Over-broad invocation increases the risk that sensitive financial files are processed unexpectedly or that this skill is selected when a safer, more specific workflow should apply.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: When the bank input is a PDF, the code automatically creates a new _extracted.xlsx file containing parsed bank statement data. Although the script prints a completion message afterward, there is no prior warning, confirmation, or inline documentation near this file-write path to disclose that sensitive financial data will be materialized as a separate workbook.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill notes that PDF processing creates a companion extracted workbook beside the input PDF, but the instructions do not prominently warn users that new files will be written near their source data. This can lead to unexpected artifact creation in sensitive directories, accidental disclosure via synced folders, or overwrite/confusion risks in shared workspaces.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script writes a multi-sheet XLSX reconciliation report to output_path, which contains financial transaction and ledger data. While report generation is central to the script's purpose and a completion message is printed after the fact, there is no explicit upfront disclosure in code comments, docstrings, or a confirmation that sensitive data will be written to disk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.