Cashflow

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:36 AM UTC
• Version: 2.0.1

Overview

CashFlow is a local-only logging tool, but it handles sensitive finance-like records with misleading deletion behavior and weak privacy controls.

Install only if you are comfortable with a simple local text logger rather than a full cash-flow tracker. Avoid storing highly sensitive financial details unless you place `CASHFLOW_DIR` in a private directory, and do not rely on `cashflow remove` to delete saved records.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:5

Finding

Permissive File Permissions May Expose Sensitive Financial Records

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 5-7, 30, and 54
Vulnerability Type: Sensitive data exposure through insecure default file permissions
Risk Level: Medium

Vulnerable Code

bash

DATA_DIR="${CASHFLOW_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/cashflow}"
DB="$DATA_DIR/data.log"
mkdir -p "$DATA_DIR"

bash

_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

bash

cmd_add() {
    echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo "  Added: $*"
    _log "add" "${1:-}"
}

Technical Analysis

The script stores potentially sensitive personal financial information in data.log and command details in history.log, but it does not establish a restrictive umask or explicitly set permissions on the storage directory and files.

Consequently, permissions are inherited from the invoking process. With a common umask of 022, mkdir -p typically creates the directory with mode 0755, while shell redirection creates log files with mode 0644. On a multi-user system, these modes may allow other local accounts to traverse the data directory and read both logs.

The exposure depends on the effective permissions of parent directories and the process umask. It is therefore not guaranteed on every installation, but the script does not enforce the confidentiality expected for financial records.

Attack Path

1. A user invokes cashflow add and records an expense, income item, balance, or private note.
2. The script creates the data directory and log files using the caller's default umask.
3. Under permissive defaults, the resulting directory and files are readable by other local users.
4. Another local account accesses data.log or history.log.
5. The account obtains the stored financial entries, command arguments, or search terms without authorization.

The attacker must already possess local access and sufficient traversal permissions for the relevant parent directories. This ...[truncated 589 chars]

Remediation

View remediation

Remediation Suggestions

1. Set a restrictive file-creation mask before creating any storage:

bash

umask 077

2. Create and enforce owner-only permissions on the data directory:

bash

mkdir -p -- "$DATA_DIR"
chmod 700 -- "$DATA_DIR"

3. Secure existing and newly created log files:

bash

touch -- "$DB" "$DATA_DIR/history.log"
chmod 600 -- "$DB" "$DATA_DIR/history.log"

4. Validate that DATA_DIR is owned by the current user and reject unsafe locations, such as directories owned by another account or writable by group/others.

5. Document that CASHFLOW_DIR must point to a private, user-owned directory.

6. Consider using printf instead of echo for predictable handling of user-supplied text:

bash

printf '%s %s\n' "$(date +%Y-%m-%d)" "$*" >> "$DB"
printf '%s %s: %s\n' "$(date '+%m-%d %H:%M')" "$1" "$2" >> "$DATA_DIR/history.log"

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as a personal cash-flow tracker, but the documentation describes a generic logging utility with unrelated commands and persistent audit logging. This mismatch can cause users to trust it with sensitive financial data under false assumptions, increasing the risk of privacy exposure and misuse because important behaviors like history retention and lack of real balance/accounting features are not clearly aligned with the stated purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest and introductory documentation describe different products: one suggests a finance tracker, while the other describes a general-purpose terminal data logger. In a finance context, this discrepancy is security-relevant because users may enter sensitive personal financial information expecting purpose-limited handling, while the skill actually supports broader arbitrary data collection and persistence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill stores a persistent history of every command in history.log without prominently warning users near the main description or command list. Because entries may contain sensitive financial details, this creates a meaningful privacy and forensic exposure risk: even deleted or exported records may still leave traces in the audit log, and users may not realize their command usage and data are being retained.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

export prints the complete dataset to stdout, but the documentation does not clearly warn that this can expose all stored financial records to shell history, terminal logs, pipes, redirection targets, or higher-level agent logging. In the context of personal finance data, accidental disclosure through normal shell workflows materially increases confidentiality risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a skill for tracking personal cash flow with simple terminal commands, but the help text advertises a "Multi-purpose utility tool" with generic commands like run, config, status, init, and info. Several commands do not implement cash-flow-specific behavior, so the actual exposed behavior is broader and semantically different from the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script persistently logs user-supplied arguments to a history file without notice, which can capture sensitive financial descriptions, account references, search terms, or other private data. In the context of a personal cash-flow tool, this is more dangerous because users are likely to enter confidential spending information and may not expect a secondary audit trail outside the main data file.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

For a cash-flow tracker, a remove command would be expected to delete an expense or record from local storage. Instead, this function only prints a removal message and appends an audit entry to history.log, creating a mismatch between the apparent behavior and the actual operation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest says the skill is for personal cash-flow tracking, but the 'When to Use' section explicitly recommends 'expenses, tasks, notes.' This is not just incomplete documentation; it actively contradicts the declared intent by presenting non-financial use cases as supported purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The help text presents commands such as run, config, status, init, and remove as substantive actions, but their implementations merely echo a message and write to history.log. This is more than incomplete documentation because the listed verbs actively suggest real state-changing or operational behavior that the code does not perform.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.