splitwise-mcp

• Outcome: Review
• Latest audit: Sep 17, 2026 · 11:58 PM UTC
• Version: 3.0.0

Overview

This Splitwise skill is mostly coherent, but it needs careful review because it can change financial and group data and writes receipts to disk by default without clear confirmation guidance.

Install only if you are comfortable giving this MCP server access to your Splitwise account, including the ability to create, update, delete, or restore expenses and modify groups, friends, comments, and profile data. Use explicit confirmations for any write/delete action, prefer inline or text receipt retrieval unless you intentionally want files written, and store the API key with the same care as other account credentials.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

MCP Config Access

High

• Category: Agent Snooping

Content

### Option A — npx (recommended)

Add to `.mcp.json` in your project or `~/.claude/mcp.json`:

```json
{

• Confidence: 95% confidence
• Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest advertises Splitwise expense/group access but omits several implemented capabilities, including destructive operations and receipt file handling. This creates an incomplete trust boundary for users and orchestrators, increasing the chance that the skill is invoked without appropriate safeguards for deletion, profile changes, or server-side file writes.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger description is broad enough to match many ordinary expense- or group-related phrases, which can cause over-invocation of a skill with write and delete capabilities. In context, this is riskier than a read-only skill because ambiguous routing could expose financial data or prepare state-changing actions without clear user intent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill describes destructive and data-writing operations such as create, update, delete, undelete, and receipt file output without requiring confirmation or warning guidance. For a financial/group-management integration, accidental execution could alter balances, memberships, comments, or persist sensitive receipts with limited opportunity for recovery.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The receipt tool can write files to the server filesystem, which expands the skill from API mediation into local file I/O. In an agent environment this is dangerous because it may persist sensitive financial documents on disk unexpectedly, leak data across sessions or tenants, or write into locations the operator did not intend.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Response shape (`view`)

Nine read tools take `view: "compact" | "full"`, and **`compact` is the
default** — you get the slim rung without asking. Two of them are not in the
table above: `sw_get_user(id, view?)` and `sw_get_comments(expense_id, view?)`.

This is not a nicety. A live `sw_list_groups` on a 51-group account came back

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The documentation tables omit destructive and profile-modifying tools that are later acknowledged as implemented, creating a misleading picture of the exposed tool surface. This inconsistency can cause downstream policy engines, reviewers, or users to underestimate the skill's ability to modify or delete data.

Static analysis

No suspicious patterns detected.