Security audit

Ach Volume Estimator

Security checks for vulnerabilities and agentic risk

Overview

The skill performs the advertised ACH volume estimate, but it also includes under-disclosed revenue forecasting, revenue calibration data access, external SOFR fetching, and dashboard writes around sensitive business data.

Review before installing. This skill should only be used if you intend to grant access to the named Gmail KPI emails and attachments, allow local report/dashboard writes, and also accept the broader revenue forecasting and calibration behavior. If the intended approval is only ACH volume estimation, remove or disable the revenue scripts and SOFR fetch, tighten activation wording, and require confirmation before cron use or mailbox access.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description captures part of the functionality—ACH volume estimation using business-day normalization and the Fed holiday calendar—but it omits several material capabilities and inaccurately states that the skill extracts transactions and business days from email data. This code is a command-line forecasting engine that accepts numeric inputs directly, relies heavily on built-in historical monthly actuals, and generates model-based forecasts with seasonality, trend, confidence bands, spillover adjustments, and quarter/year rollups. It also exposes an optional revenue-forecast integration not mentioned in the declaration. These are not just implementation details; they materially expand and alter the skill’s primary behavior beyond a simple end-of-month estimate from KPI emails.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is about projecting monthly ACH transaction volume from daily KPI emails using transaction counts, business days, and a holiday calendar. The supplied code does none of that. It reads a local JSON calibration file at ~/clawd/work/bionics/revenue_calibration.json, inspects the latest calibrated month, compares it to the expected previous month, computes staleness based on a stored calibration date, and optionally checks volatility in recent revenue-per-transaction rates. Its domain is revenue calibration status, not ACH KPI email processing or monthly volume forecasting. This is a clear material mismatch in purpose, inputs, and behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This is a clear description/behavior mismatch. The declared purpose is narrowly about estimating monthly ACH transaction volume from KPI emails using transaction counts, business days, and a bank holiday calendar. The supplied code instead assumes ACH projections are already provided or imported from another module, and its primary function is projecting revenue. It models transaction revenue rates, adds FBO revenue, computes ACH share ratios from historical actuals, produces month/quarter/year revenue scenarios, checks model drift, and optionally fetches SOFR from the internet. There is no email extraction logic and no business-day or Federal Reserve holiday calendar logic in this chunk. The primary purpose is materially different from the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description centers on estimating monthly ACH volume from daily KPI emails. This code chunk instead acts primarily as a dashboard updater/orchestrator: it invokes an external estimate.forecast function, augments results with revenue and historical comparison fields, and updates dashboard HTML and JSON files on disk. Those file-modification and dashboard-patching behaviors are materially undeclared. Also, the described email-data extraction capability is not present here; inputs come from CLI arguments or an existing JSON file. While the code supports monthly ACH forecasting, its actual scope and side effects are broader and operationally different from the declared purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file's documented behavior is unrelated to the declared skill purpose: instead of estimating ACH end-of-month volume from KPI emails, it performs revenue calibration checks against a separate revenue dataset. This kind of capability mismatch is dangerous because it can cause the wrong data domain to be accessed and acted upon in automation, leading to unauthorized data use, incorrect business decisions, and hidden cross-skill behavior that operators would not expect from the skill metadata.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file explicitly expands an ACH monthly volume estimator into a broader revenue forecasting tool, including transaction revenue, FBO income, and annualized projections. This is dangerous because it materially exceeds the declared skill scope, increasing the chance that a caller invokes the skill expecting limited ACH estimation while the code processes additional financial logic and produces more sensitive business outputs than advertised.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The main forecast path generates month-end, quarter, year, scenario, drift, and revenue analyses rather than only monthly ACH transaction volume estimates. In a security context, this is a scope-deception issue: downstream systems or users may trust the skill under narrower governance while it actually computes and exposes richer financial forecasts that may affect decision-making or data handling.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill invokes Gmail access, downloads attachments, reads local files, writes output files, and serves/generated dashboard content, yet it declares no explicit tool scope or permissions. That omission weakens least-privilege controls and makes it easier for an agent runtime to grant broader capabilities than the user would reasonably expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation guidance is broad enough to trigger on routine discussion like 'when Dave asks about monthly volume projections,' which can cause unnecessary access to email, attachments, and local reporting workflows. Overbroad activation increases the chance of the skill running in unintended contexts and handling sensitive data without a clear user request.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions direct access to a named personal Gmail account and downloading PDF attachments, but provide no privacy warning, consent check, or data-minimization guidance. In context, this is more dangerous because KPI emails and attachments may contain sensitive business metrics, client information, and internal reporting data, creating a real risk of unauthorized exposure or over-collection.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a skill for estimating ACH end-of-month transaction volume from KPI email data. The code adds an optional --with-revenue path that imports a separate revenue forecasting module and augments the output with quarter/year revenue projections, which is a materially different business function than volume estimation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The module documentation says it runs on BD 5 and implies calibration expectations are tied to business-day timing. However, the implementation simply treats the expected month as the prior calendar month based on today's date and does not calculate or verify business day 5 at all, contradicting the stated operational logic.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code reads a local revenue calibration file under a path unrelated to ACH KPI email processing, which indicates cross-domain data access beyond the skill's stated purpose. In this skill context, that makes the behavior more dangerous because users invoking an ACH volume estimator would not expect it to touch revenue calibration data, creating least-privilege violations and increasing the risk of unintended exposure of sensitive financial information.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The code performs outbound network access to fetch SOFR data from FRED, even though the skill is described as an ACH volume estimator based on daily KPI emails. This increases attack surface and data-governance risk by introducing an undeclared external dependency, potential metadata leakage, and non-deterministic behavior tied to a third-party service.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest is specifically about estimating ACH transaction volume, but this code imports and runs a separate revenue forecasting pipeline and embeds its results into the output. Revenue projection is a materially different business capability than volume estimation and is not mentioned in the declared skill purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest describes a skill for estimating end-of-month ACH transaction volume from KPI emails, but this file performs in-place modification of a local HTML dashboard and writes a JSON data file. Those write-side dashboard publishing behaviors go beyond the stated estimation/extraction purpose and are not just an obvious implementation detail of producing a forecast.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The module docstring presents the script's usage modes as transaction/per-BD/forecast-only estimation, implying the script is limited to ACH volume forecasting. However, the implemented CLI also supports --with-revenue and invokes a revenue forecast module, so the documentation does not match the actual behavior and understates the skill's scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill makes an outbound request without any explicit user-facing notice or confirmation, which is risky in an internal analytics tool whose stated purpose does not imply network activity. Even though the destination is a public data source, silent network access can violate least surprise, complicate compliance review, and leak operational metadata such as timing and environment egress behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring identifies the tool as 'Revenue Forecaster v2.0', while the CLI parser description says 'Revenue Forecaster v1.0'. This is an active documentation inconsistency that can mislead operators about which model version is running.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.