Intelligent Budget Tracker

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:28 AM UTC
• Version: 1.0.1

Overview

The skill has a coherent money-tracking purpose, but it asks users to install an unaudited npm package that handles sensitive financial data and does not clearly explain LLM data handling or backup/export protections.

Review this before installing. Use a sandbox or least-privileged account, pin and verify the npm package version, and avoid entering real financial data until you know where LLM processing happens and how local files, exports, and backups are protected.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned and Unauditable Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–16
Vulnerability Type: Unpinned external npm dependency
Risk Level: Medium

Vulnerable Code

markdown

## Installation

```bash
npm install agent-money-tracker

text

### Technical Analysis

The installation command retrieves the current registry-selected version of `agent-money-tracker` without an exact version pin, committed lockfile, integrity hash, or bundled implementation. The audited project contains only `SKILL.md`, so the package implementation and its security properties cannot be verified from the supplied artifact.

npm packages may run lifecycle scripts during installation. A compromised publisher account, malicious new release, or supply-chain compromise could therefore introduce code that executes with the installing user's privileges. The package is also intended to process and persist sensitive financial information, increasing the consequences of dependency compromise.

The audit found no direct evidence that the named package is malicious. The vulnerability is the unsafe and unverifiable dependency acquisition process.

### Attack Path

1. An attacker compromises the package publisher, registry delivery chain, or a subsequently released package version.
2. The attacker publishes a malicious release under the package name used by the documentation.
3. A user follows the documented command, and npm resolves the unpinned dependency to that release.
4. Malicious package code may execute through npm lifecycle scripts during installation or when the library is imported and initialized.
5. The code runs with the user's privileges and may access files available to that account, including the financial records managed by the library.

### Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running npm or the consuming agent. The accessible scope may include the application's financial records, exported data, bac
...[truncated 204 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to an exact version that has undergone security review rather than relying on the registry-selected current release.
• Include a committed lockfile containing integrity metadata and enforce reproducible installation with npm ci.
• Add the package manifest and auditable implementation to the review artifact, or otherwise provide provenance and source references for the exact distributed package.
• Verify package ownership, release provenance, signatures or attestations, and registry integrity before installation.
• Disable lifecycle scripts where they are unnecessary, for example by using npm install --ignore-scripts, after confirming that this does not break required functionality.
• Run installation and execution under a least-privileged account or sandbox with narrowly scoped filesystem and network access.
• Document whether the dependency performs network communication and how stored financial information, exports, and backups are protected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises LLM-powered natural-language parsing and financial insights but does not disclose whether user financial data is processed locally or transmitted to an external model or API. Because the data involved includes expenses, income, merchants, budgets, and savings goals, undisclosed external transmission could expose highly sensitive personal financial information to third parties, retention systems, or model training pipelines.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill handles highly sensitive financial records and explicitly supports storage, export, and backups, but the documentation provides no warning about confidentiality, local file exposure, backup retention, or secure handling of exported data. In an agent context, these features can cause silent propagation of complete financial histories into insecure paths, logs, shared directories, or downstream tools without the user understanding the privacy risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.