Smart Accountant with GST Understanding

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:33 AM UTC
• Version: 1.0.0

Overview

This accounting skill openly manages a local ledger, but its posting and correction scripts can make financial changes without reliably enforcing the stated approval and audit controls.

Install only in a test or non-production accounting workspace unless you add real approval enforcement, dry-run/confirmation gates, atomic rectification, reversal idempotency, date-aware period controls, and read-only preview behavior. Treat the included scripts as capable of changing financial records in the local SQLite database.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: tool/scripts/post-voucher.js:14

Finding

Maker-checker approval can be self-asserted or bypassed

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: tool/scripts/rectify-entry.js:14

Finding

Rectification is non-atomic and can leave a committed reversal without a replacement

Content

View full analysis

`. 4. `reverseVoucher()` posts and commits the reversal. 5. Reading, parsing, validating, or posting the replacement fails. 6. The command exits without restoring the original accounting position. 7. The database permanently contains the reversal but not the intended corrected voucher. ### Impact Assessment The flaw can cause partial accounting updates, incorrect balances, incomplete rectifications, and reconciliation failures. An actor with permission to run ...[truncated 236 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: tool/scripts/reverse-voucher.js:4

Finding

Voucher reversal permits repeated, chained, and state-invalid reversals

Content

View full analysis

({ ledger_id: line.ledger_id, debit: line.credit, // swap credit: line.debit })); const reversedVoucher = { ...voucher, id: undefined, // let it auto-increment voucher_no: null, // generate new status: 'POSTED', narration: `Reversal of ${voucher.voucher_no}: ${voucher.narration || ''}` }; return engine.postVoucher(reversedVoucher, reversedLines); } ``` ### Technical Analysis The reversal function checks only whether a voucher exists. It does not require the source voucher to be `POSTED`, reject a source already marked `REVERSED`, prevent reversal of another reversal, or atomically mark and link the original voucher. No `reversal_of` field or unique database constraint exists. The generated reversal also inherits fields such as the original request ID when present, producing inconsistent behavior depending on whether the source voucher had an idempotency key. Where no request ID exists, the same source can be reversed repeatedly. ### Attack Path 1. Identify a voucher without a request ID. 2. Run `node scripts/reverse-voucher.js `. 3. A posted offsetting voucher is created. 4. Run the same command again with the same source voucher. 5. Another posted offsetting voucher is created because the original was not marked as reversed. 6. Repeat the operation or target one of the generated reversal vouchers to create chained rever ...[truncated 419 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: tool/lib/validators.js:31

Finding

Closed-period validation ignores the voucher date

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: tool/lib/validators.js:3

Finding

Incomplete numeric and journal-line validation permits semantically invalid vouchers

Content

View full analysis

0.001) { throw new Error(`Unbalanced entry. Total Debits (${sumDebit}) != Total Credits (${sumCredit})`); } } ``` ### Technical Analysis The validators check field presence and mathematical equality but do not enforce the complete accounting data model. In particular, they do not: - Require finite numeric values for the header amount, debit, and credit. - Validate the date syntax or calendar validity. - Require total debits and credits to be greater than zero. - Reconcile the header amount with journal-line totals. - Prohibit both debit and credit from being populated on the same line. - Require ledger IDs to be valid integers before posting. - Enforce currency precision using fixed-point arithmetic. For example, a positive header amount and two lines with zero debit and zero credit pass the completeness and double-entry checks. Balanced line totals unrelated to the header amount also pass. ### Attack Path 1. Create a voucher with a valid type, nonzero header amount, and date ...[truncated 755 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: tool/lib/gst-engine.js:3

Finding

Voucher preview unexpectedly writes GST ledgers to the database

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (19)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

ized, the system uses the scripts in `tool/scripts/` (e.g., `post-voucher.js`, `generate-report.js`) as the primary interface for all ledger operations.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · audit_rule.md (reported line 418)May include surrounding context.

md

Agent may not:
- self approve
- auto submit without confirmation

Required Flow

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The DELETE example shows direct record removal with no accompanying warning that the action is irreversible and affects persisted user data. In markdown guidance for a persistence skill, destructive data operations should include an explicit caution so users understand the impact before applying the pattern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example node sqlite-util.js exec "update customers set balance=0" demonstrates a destructive bulk update without any warning, guardrail, or confirmation step. In an agent-operated wrapper, such examples normalize unsafe behavior and can lead to accidental mass data corruption or loss when an agent follows the pattern literally.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The utility wrapper accepts arbitrary SQL from command-line arguments and executes it directly with db.prepare(sql).all() or db.exec(sql), which defeats the document's own guidance to use parameterized queries. In an agent context, this is especially risky because upstream prompts, tool inputs, or untrusted task data may be transformed into SQL, enabling injection, unauthorized reads, schema modification, or destructive writes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The file states that historical ledger data must be append-only and explicitly forbids UPDATE operations on ledger/balance-like data. However, later sections direct the posting workflow to 'update derived balances' and to maintain materialized summary tables during posting, which introduces mutation behavior that conflicts with the earlier absolute immutability language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown section documents db-maintenance.js commands such as VACUUM, ANALYZE, and wal_checkpoint(FULL) plus backup/optimize/checkpoint actions, but it does not warn that these operations modify the database file, can lock or pause access, and should be run with care. Under the markdown-specific SQP-2 criteria, behaviours affecting system integrity should include a clear user-facing warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The migrate-schema.js section declares the only allowed schema change path, but it does not warn users that migrations can irreversibly alter data structures, break compatibility, or require verified backups and rollback plans. Because this markdown describes behaviour that can affect user data and system integrity, a clear warning is expected.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · gst_guard.md (reported line 102)May include surrounding context.

md

reverse_charge_flag
)

Do NOT use simplistic rule:

if gstin_matches...

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · rectification.md (reported line 110)May include surrounding context.

md

→ Confirmed
→ Posted

Do not skip confirmation.

---

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · rectification.md (reported line 473)May include surrounding context.

md

Prevent if possible.
Correct if necessary.

Never auto-post without asking:

Are you sure of this entry?

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This function inserts voucher records, line items, and audit-log entries, which are persistent data writes with business impact. The file contains no confirmation prompt, user-facing logging, or explanatory docstring/comment warning that calling this function will create posted accounting records and audit entries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script performs a destructive accounting workflow by automatically reversing an existing voucher and then force-setting the replacement voucher status to POSTED without any confirmation, dry-run, or independent validation. In a financial posting context, this increases the risk of accidental or unauthorized ledger changes, especially if the input file is incorrect, malformed, or supplied by an untrusted operator.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The colloquial trigger list is intentionally broad and includes vague phrases such as 'adjust this', 'pass entry', and 'make receipt' that can map to multiple accounting actions. In an automation context, this can cause unintended invocation or transaction misclassification, potentially creating incorrect financial entries or prompting the wrong voucher workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file includes a section labeled "Indian + Global Usage" with locale-specific Hinglish phrases such as "journal karo," "contra maaro," and "bill punch karo" without indicating that this language convention is optional or region-specific. This can violate language/locale policy because the skill embeds a specific linguistic mode without documented user choice or justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The preview script is documented as a dry-run with 'No writes,' yet the overall posting flow and audit rules describe mandatory audit-related actions around validation/preview/commit. That creates intent ambiguity about whether preview is strictly read-only or whether audit/enforcement activity may write records during preview.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The example phrase "Bought stock on udhar" uses a Hindi/Urdu term, which bakes a specific locale/language assumption into the skill guidance. The file does not offer users a language choice or explain that the skill is intended for a specific regional context, so this can conflict with language/locale policy requirements.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency version is not pinned to an exact release and uses a caret range (^11.10.0), which permits automatic installation of newer minor and patch versions. This can introduce supply-chain risk and reduce build reproducibility if a compromised or breaking upstream release is published and later resolved during install.

Content

Scanner excerpt · tool/package.json (reported line 16)May include surrounding context.

json

"license": "ISC",
  "description": "",
  "dependencies": {
    "better-sqlite3": "^11.10.0"
  }
}

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code reads posted voucher details and outputs dates, voucher numbers, debit/credit amounts, and narration directly to stdout. While the script has usage/error messages, it provides no disclosure that running it will reveal potentially sensitive accounting data, and there is no surrounding comment or docstring warning about that behavior.

Content

No source excerpt is available for this finding.