T01 · Skill Instruction Hijacking
Note
- Location
scripts/mortgage.sh:325- Finding
Forced Promotional Content in Calculator Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Mortgage Calculator
Security checks for vulnerabilities and agentic risk
Overview
This package is not just a mortgage calculator; it also stores and exports local financial notes, and its delete command appears not to delete stored records.
Review before installing. Treat this as a local plaintext financial log, not merely a calculator. Avoid entering sensitive mortgage, income, account, or lender details unless you are comfortable with them being stored under ~/.local/share/mortgage-calculator or the configured data directory and exported to stdout. Do not rely on the remove command to erase records unless the implementation is fixed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:60- Finding
Remove Command Falsely Reports Record Deletion
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a mortgage calculator, but the documented behavior is a generic local data logging and export utility that stores arbitrary user-provided content and command history. This mismatch is dangerous because users and agent frameworks may grant trust or invoke the skill for benign calculation tasks while it actually performs persistent data collection, increasing the risk of unauthorized retention and exposure of sensitive financial information.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The manifest advertises a mortgage payment calculator, but the body describes a plaintext local record manager with add/search/remove/export operations. This is a substantive security-relevant integrity issue because deceptive capability descriptions can cause sensitive mortgage or financial notes to be stored locally and exported without users realizing the tool is not just performing calculations.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The implementation materially contradicts the declared purpose: instead of mortgage calculations, it provides a generic local data collection, search, logging, and export utility. This kind of capability mismatch is dangerous because it can mislead users or higher-level agents into invoking a tool that stores and exposes arbitrary input data under the guise of a benign financial calculator.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The title and top-level description frame the skill as a calculator, but the immediately following body text describes a multi-purpose structured-data logging tool. Even if not overtly malicious, this inconsistency can mislead users into providing sensitive financial data under the assumption of ephemeral calculation rather than retained local storage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill encourages storing mortgage and financial records locally in plaintext files and logging command history, but it does not warn about privacy, local filesystem exposure, backups, multi-user system access, or accidental export. In the mortgage context, the stored content may include highly sensitive personal financial data, making silent plaintext persistence a meaningful confidentiality risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This shell script presents help text, command usage, recommendations, and other natural-language output only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The inline documentation explicitly describes the tool as a 'Multi-purpose utility tool,' which conflicts with the stated mortgage-calculator identity. In the context of agent skills, misleading documentation increases the risk that hidden or unjustified capabilities are smuggled into a seemingly harmless skill and used without informed consent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script creates a persistent data directory, stores arbitrary user content in a local database file, and supports listing and exporting that data, none of which is necessary for mortgage payment calculations. This unnecessary persistence broadens the attack surface by enabling unintended collection, retention, and disclosure of user-supplied information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The logging helper writes user-supplied command arguments to a persistent history file without disclosure, which can capture sensitive financial details, file paths, or other private input. Even if intended for debugging or auditability, silent retention of inputs is risky in a mortgage-related context where users may provide confidential loan information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The add command persists arbitrary user-provided content to a local data file without any indication in the help text that data will be stored. This creates a privacy and transparency issue because users may assume they are interacting with a simple calculator, not a tool that records free-form input for later retrieval or export.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The example entries use the yen symbol and present the workflow as if a specific currency/locale is assumed, but the skill does not state that it is Japan-specific or offer users a choice of currency/locale. That can conflict with language/locale neutrality expectations for general-purpose skills.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file is entirely presented in Chinese, and there is no indication that the user can choose another language or that the locale restriction is intentional and documented. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a reportable issue.
- Content
Static analysis
No suspicious patterns detected.