Sap Journal Auditor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:51 AM UTC
• Version: 0.1.0

Overview

The skill mostly does what it claims, but it asks for more authority than it needs and handles sensitive financial exports with unsafe persistent output and parsing risks.

Review before installing in environments with sensitive SAP exports. Use it only in a sandboxed workspace with limited filesystem access, remove shell permission if possible, avoid opening generated CSVs from untrusted source data until formula-neutralization is fixed, and verify dependency updates or compensating size/time limits for spreadsheet parsing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: lib/reporter.js:227

Finding

Mandatory Third-Party Branding and External Links in Generated Reports

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: lib/exporter.js:14

Finding

Spreadsheet Formula Injection in Flagged CSV Exports

Content

View full analysis

[ f.id, f.risk, f.checkType, (f.docNumbers || []).join("; "), f.amount !== undefined ? String(f.amount) : "", f.currency || "", f.account || "", f.costCenter || "", fmtDate(f.postingDate), f.user || "", f.description || "", f.recommendation || "", ]); const lines = [headers.map(escapeCSV).join(","), ...rows.map((r) => r.map(escapeCSV).join(","))]; fs.writeFileSync(outputPath, lines.join("\n"), "utf8"); ``` ### Technical Analysis The exporter correctly escapes commas, quotes, and newlines, but it does not neutralize values interpreted as formulas by spreadsheet applications. Journal-controlled fields—including document numbers, currency, account, cost center, user, and values embedded into descriptions—can reach the CSV export. Cells beginning with characters such as `=`, `+`, `-`, or `@` may be evaluated as formulas when the generated file is opened in Microsoft Excel, LibreOffice Calc, or similar software. CSV quoting alone does not reliably prevent formula evaluation. ### Attack Path 1. An attacker supplies or influences a journal field with a value such as `=HYPERLINK("https://attacker.example","Review document")`. 2. The parser preserves the value as a string. 3. An audit finding copies the field into `docNumbers`, `account`, `costCenter`, `user`, or a description. 4. `escapeCSV` performs syntactic CSV quoting but does not neutralize the leading formula character. 5. A reviewer opens `flagged_entries.csv` in spreadsheet software. 6. The spreadsh ...[truncated 514 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: skill.json:34

Finding

Unnecessary Shell Permission Violates Least Privilege

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: lib/xlsx-lite.js:20

Finding

Unbounded Synchronous XLSX Decompression Enables Denial of Service

Content

View full analysis

]*name="([^"]*)"[^>]*r:id="([^"]*)"/); if (!sheetMatch) throw new Error("No sheets found in workbook"); ``` ### Technical Analysis The fallback XLSX reader loads the complete uploaded file into memory and synchronously inflates selected ZIP entries. It does not enforce: - A maximum uploaded-file size. - A maximum expanded-entr ...[truncated 1334 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:85

Finding

Predictable Output Paths Permit File Overwrite and Symlink Redirection

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

brace-expansion 1.1.12 is flagged with multiple DoS advisories affecting expansion parsing. Although it appears only as a transitive devDependency here, vulnerable globbing/parsing logic can still be exercised during local tooling or CI runs, causing hangs or memory exhaustion if attacker-controlled patterns are processed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: flatted==3.3.4 — 2 advisory(ies): CVE-2026-32141 (flatted vulnerable to unbounded recursion DoS in parse() revive phase); CVE-2026-33228 (Prototype Pollution via parse() in NodeJS flatted)

High

• Category: Supply Chain
• Confidence: 87% confidence

Finding

flatted 3.3.4 is reported vulnerable to prototype pollution and unbounded recursion during parse revival. In this lockfile it is only present as a transitive devDependency, which lowers exposure, but a vulnerable parser in tooling can still be abused in development or CI contexts if attacker-controlled serialized input is processed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 89% confidence

Finding

js-yaml 4.1.1 has multiple CPU consumption advisories related to merge-key and mapping resolution. Here it is a transitive devDependency of eslint tooling rather than application runtime code, which reduces but does not eliminate risk because malicious YAML config processed in CI or local lint workflows could trigger denial of service.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: xlsx==0.18.5 — 2 advisory(ies): CVE-2023-30533 (Prototype Pollution in sheetJS); CVE-2024-22363 (SheetJS Regular Expression Denial of Service (ReDoS))

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

xlsx 0.18.5 is a direct runtime dependency with known prototype pollution and ReDoS issues. In the context of a journal-auditing skill that likely ingests user-supplied spreadsheet files, this is especially relevant because crafted XLSX content could cause process slowdown, denial of service, or unsafe object mutation during parsing.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: xlsx==0.18.5 — 2 advisory(ies): CVE-2023-30533 (Prototype Pollution in sheetJS); CVE-2024-22363 (SheetJS Regular Expression Denial of Service (ReDoS))

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

xlsx 0.18.5 is affected by known issues including prototype pollution and regular-expression denial of service. This is especially relevant here because the skill is explicitly designed to ingest spreadsheet-based journal entry exports; a malicious or crafted workbook from an untrusted source could crash processing, hang the audit workflow, or corrupt application logic through polluted objects.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · CODE_OF_CONDUCT.md (reported line 15)May include surrounding context.

md

## Unacceptable Behavior

- Harassment, personal attacks, or discrimination.
- Sharing private information without consent.
- Disruptive or off-topic behavior.

## Enforcement

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrase 'review postings' is broad enough to match ordinary accounting requests that may not specifically intend to invoke this skill. That can cause unintended activation, especially in enterprise environments where users commonly discuss reviewing postings in routine workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The phrase 'flag anomalies' is highly generic and lacks any SAP, journal, or finance-specific constraint. Because many unrelated tasks may ask to 'flag anomalies,' this creates a higher risk of accidental invocation and misrouting of user requests to the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill writes audit artifacts derived from SAP journal data directly to disk in the same directory as the uploaded file, creating audit_memo.md and flagged_entries.csv without explicit user consent or any retention/cleanup controls. Because SAP FI/CO exports commonly contain sensitive financial and user activity data, these files can persist on shared hosts, agent workspaces, or backup systems and be exposed to other users or processes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest trigger list includes generic phrases such as "audit journal," "check journal entries," "review postings," and "flag anomalies" without narrowing context or exclusion conditions. In a manifest file, these broad activators can cause unintended invocation because they are not specific to this exact skill or usage boundary.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: csv-parse==5.6.0 — 1 advisory(ies): CVE-2026-85063 (node-csv: Prototype replacement still reachable via columns path)

Low

• Category: Supply Chain
• Confidence: 78% confidence

Finding

csv-parse 5.6.0 is a direct runtime dependency and is reported vulnerable to prototype manipulation via a columns-related parsing path. Because this skill appears to process CSV input, untrusted spreadsheet data could potentially trigger object-shape corruption or downstream logic issues if unsafe parsing options are used.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 40)May include surrounding context.

json

},
  "homepage": "https://github.com/dda-oo/sap-journal-auditor#readme",
  "dependencies": {
    "csv-parse": "^5.5.0",
    "xlsx": "^0.18.5"
  },
  "devDependencies": {

Known Vulnerable Dependency: csv-parse==5.6.0 — 1 advisory(ies): CVE-2026-85063 (node-csv: Prototype replacement still reachable via columns path)

Low

• Category: Supply Chain
• Confidence: 71% confidence

Finding

The allowed csv-parse version includes a release with a reported prototype replacement issue reachable via the columns path. In a skill that audits SAP journal exports from CSV files, parsing attacker-controlled or untrusted CSV input could let malformed data tamper with object behavior, potentially causing logic corruption or unsafe downstream handling.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 41)May include surrounding context.

json

"homepage": "https://github.com/dda-oo/sap-journal-auditor#readme",
  "dependencies": {
    "csv-parse": "^5.5.0",
    "xlsx": "^0.18.5"
  },
  "devDependencies": {
    "eslint": "^8.0.0"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 44)May include surrounding context.

json

"xlsx": "^0.18.5"
  },
  "devDependencies": {
    "eslint": "^8.0.0"
  },
  "engines": {
    "node": ">=16.0.0"