Mortgage Calculator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:23 PM UTC
• Version: 2.0.1

Overview

This package is not just a mortgage calculator; it also stores and exports local financial notes, and its delete command appears not to delete stored records.

Review before installing. Treat this as a local plaintext financial log, not merely a calculator. Avoid entering sensitive mortgage, income, account, or lender details unless you are comfortable with them being stored under ~/.local/share/mortgage-calculator or the configured data directory and exported to stdout. Do not rely on the remove command to erase records unless the implementation is fixed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Note

• Location: scripts/mortgage.sh:325
• Finding: Forced Promotional Content in Calculator Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mortgage.sh`, lines 325-326 **Vulnerability Type**: Forced promotional output **Risk Level**: Low ### Vulnerable Code ```bash echo "" echo " Powered by BytesAgain | bytesagain.com | [e-mail]" ``` ### Technical Analysis The script unconditionally appends branding, an external domain, and an email address to standard output after every successful calculator invocation. The content is unrelated to the requested financial result and cannot be disabled by the caller. When this script is used as an AI Agent skill, its standard output may be relayed directly or incorporated into the Agent's response. Consequently, the package author can force promotional content into user-visible responses. This affects output integrity, although the reviewed code does not use the promotional URL to retrieve content, execute code, or alter the Agent's safety constraints. ### Attack Path 1. An Agent invokes `scripts/mortgage.sh` to perform a mortgage calculation. 2. The embedded Python program prints the requested calculation. 3. After Python exits, the shell script unconditionally prints the promotional footer. 4. The Agent captures the complete standard output. 5. If the Agent relays that output, the user receives author-selected advertising alongside the requested result. ### Impact Assessment The issue affects the integrity and neutrality of calculator output. It can expose users to unsolicited external promotion and make downstream automation treat non-result content as part of the calculation response. No additional operating-system privileges, code execution, network access, persistent access, or access to confidential data is obtained through this behavior. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the unconditional promotional footer from calculator output. - If attribution is required, expose it only through an explicit command such as `about` or an opt-in flag such as `--show-attribution`. - Keep standard output machine-readable and limited to the requested result. - Send optional diagnostic or attribution information to standard error only when explicitly requested. - Add regression tests confirming that calculation commands do not append unrelated content. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:60
• Finding: Remove Command Falsely Reports Record Deletion<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh`, lines 60-63 **Vulnerability Type**: Data retention and integrity failure **Risk Level**: Medium ### Vulnerable Code ```bash cmd_remove() { echo " Removed: $1" _log "remove" "${1:-}" } ``` ### Technical Analysis The `remove` command reports that an item was removed and records a removal event in `history.log`, but it never reads or modifies `data.log`. Therefore, the claimed deletion does not occur. This violates the documented behavior of the command and creates a security-relevant mismatch between user expectations and actual data retention. Because the application is intended to store mortgage and financial notes, retained entries may contain sensitive personal or financial information. ### Attack Path 1. A user stores a financial record with the `add` command. 2. The user invokes `remove` for that record. 3. The script prints `Removed: ...` and adds a removal event to the history log. 4. The original entry remains unchanged in `data.log`. 5. A later `list`, `search`, or `export` command still discloses the supposedly deleted record. 6. Any local user or process that can read the data directory may continue to access the retained information. ### Impact Assessment The vulnerability affects data confidentiality, integrity, and lifecycle management within the configured mortgage-calculator data directory. Users may make privacy or retention decisions based on a false success message. Exploitation does not grant elevated privileges or access beyond the permissions already available to a process that can invoke the utility or read its files. The scope is limited to records stored in the configured `DATA_DIR`, but those records may include sensitive financial information. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Implement actual record deletion from `data.log`. - Assign immutable record identifiers when entries are created, and require `remove` to operate on an exact identifier rather than ambiguous free-form text. - Write the updated database to a securely created temporary file in the same directory, verify the operation, and atomically replace the original file. - Preserve restrictive file permissions during replacement. - Report success only after confirming that the selected record no longer exists. - Return a nonzero exit status if the record does not exist or deletion fails. - Clearly document whether removal affects only active records or also audit history. - Add tests proving that a removed record is absent from `list`, `search`, and `export` output. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill is presented as a mortgage calculator, but the documented behavior is a generic local data logging and export utility that stores arbitrary user-provided content and command history. This mismatch is dangerous because users and agent frameworks may grant trust or invoke the skill for benign calculation tasks while it actually performs persistent data collection, increasing the risk of unauthorized retention and exposure of sensitive financial information.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The manifest advertises a mortgage payment calculator, but the body describes a plaintext local record manager with add/search/remove/export operations. This is a substantive security-relevant integrity issue because deceptive capability descriptions can cause sensitive mortgage or financial notes to be stored locally and exported without users realizing the tool is not just performing calculations.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The implementation materially contradicts the declared purpose: instead of mortgage calculations, it provides a generic local data collection, search, logging, and export utility. This kind of capability mismatch is dangerous because it can mislead users or higher-level agents into invoking a tool that stores and exposes arbitrary input data under the guise of a benign financial calculator.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The title and top-level description frame the skill as a calculator, but the immediately following body text describes a multi-purpose structured-data logging tool. Even if not overtly malicious, this inconsistency can mislead users into providing sensitive financial data under the assumption of ephemeral calculation rather than retained local storage.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill encourages storing mortgage and financial records locally in plaintext files and logging command history, but it does not warn about privacy, local filesystem exposure, backups, multi-user system access, or accidental export. In the mortgage context, the stored content may include highly sensitive personal financial data, making silent plaintext persistence a meaningful confidentiality risk.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This shell script presents help text, command usage, recommendations, and other natural-language output only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The inline documentation explicitly describes the tool as a 'Multi-purpose utility tool,' which conflicts with the stated mortgage-calculator identity. In the context of agent skills, misleading documentation increases the risk that hidden or unjustified capabilities are smuggled into a seemingly harmless skill and used without informed consent.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script creates a persistent data directory, stores arbitrary user content in a local database file, and supports listing and exporting that data, none of which is necessary for mortgage payment calculations. This unnecessary persistence broadens the attack surface by enabling unintended collection, retention, and disclosure of user-supplied information.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The logging helper writes user-supplied command arguments to a persistent history file without disclosure, which can capture sensitive financial details, file paths, or other private input. Even if intended for debugging or auditability, silent retention of inputs is risky in a mortgage-related context where users may provide confidential loan information.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The add command persists arbitrary user-provided content to a local data file without any indication in the help text that data will be stored. This creates a privacy and transparency issue because users may assume they are interacting with a simple calculator, not a tool that records free-form input for later retrieval or export.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The example entries use the yen symbol and present the workflow as if a specific currency/locale is assumed, but the skill does not state that it is Japan-specific or offer users a choice of currency/locale. That can conflict with language/locale neutrality expectations for general-purpose skills.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This markdown file is entirely presented in Chinese, and there is no indication that the user can choose another language or that the locale restriction is intentional and documented. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a reportable issue.

Static analysis

No suspicious patterns detected.