Security audit

Smart Accountant with GST Understanding

Security checks across malware telemetry and agentic risk

Overview

This is a coherent local accounting/GST skill, but it can directly change sensitive financial records with some weak or missing safeguards.

Install only if you are comfortable reviewing and controlling the local accounting database scripts. Use a test or backed-up database first, disable or avoid raw SQL workflows, and require explicit human approval before posting, reversing, rectifying, closing periods, migrating schema, or running maintenance on real books.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The utility wrapper accepts arbitrary SQL from command-line input and passes it directly to db.prepare(sql).all() or db.exec(sql), which defeats the document's own advice to use parameterized queries. In an agent setting, where query strings may be composed from untrusted task input, this enables SQL injection, arbitrary data modification, schema destruction, and data exfiltration from the local database.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The query text includes a placeholder for `l.ledger_id = ?` but `.all()` is called without supplying the expected parameter, so the intended ledger filter is not actually enforced correctly. This can cause the script to return incorrect data or all posted ledger lines, resulting in unauthorized disclosure of accounting information and misleading output to operators.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The documentation includes a direct example of running an unrestricted UPDATE through the exec wrapper to zero all balances, without any warning, confirmation, or rollback guidance. In an agent workflow this normalizes destructive operations and makes accidental or prompt-induced mass data corruption more likely, especially because the same wrapper accepts arbitrary SQL.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill includes potentially disruptive maintenance and schema-changing operations such as VACUUM, ANALYZE, WAL checkpointing, backups, and migrations, but does not pair them with explicit approval, environment, or safety-boundary requirements. In an agent context, this can lead to unintended state-changing or availability-impacting actions being taken automatically on production data, especially because the skill otherwise frames scripts as preferred system-call-like operations.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The script silently falls back to 'Gujarat' when the owner_state_code config is missing, and that value directly influences GST determination and missed-rule validation. In a finance/accounting workflow, an incorrect default jurisdiction can produce wrong tax lines, suppress or misclassify GST checks, and mislead users because the tool prints that the entry is 'safe to confirm' based on potentially invalid assumptions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This script performs a destructive financial operation by reversing an existing voucher and then forcibly reposting replacement data from an arbitrary JSON file without any confirmation, dry-run, authorization check, or integrity validation. In an accounting context, this can enable accidental or unauthorized tampering with ledger history, and the forced `POSTED` status bypasses normal workflow controls that might otherwise prevent invalid or unreviewed entries from being committed.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The colloquial trigger phrases are broad enough to match ordinary accounting conversation such as 'pass entry', 'adjust this', or 'book this transaction', which can cause unintended skill activation or incorrect voucher routing. In this skill's context, the file is explicitly used for intent mapping, so overbroad phrases increase the chance of misclassification and accidental financial actions rather than serving as harmless documentation.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The instruction to always infer intent from action words like 'receive', 'pay', 'return', 'transfer', and 'adjust' is overly simplistic and can map incomplete or ambiguous user requests to the wrong transaction type. Because this skill appears designed to drive accounting entry selection, a bad inference could produce incorrect financial postings, especially when cash-vs-bank or sale-vs-purchase context is missing.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.