T01 · Skill Instruction Hijacking
Error
- Location
revenue_tracker.py:331- Finding
Agent instruction injection through attacker-controlled event descriptions
- Content
View full analysis
- Remediation
View remediation
Security audit
Revenue Tracker
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent revenue tracker, but it needs Review because it can persist financial data and unsanitized user text into shared agent context, generated HTML, and external-update instructions.
Review before installing. Use it only where automatic handling of financial records is acceptable, disable or gate agent-side Sheets/Notion/Telegram updates unless the user explicitly approves them, and do not feed untrusted descriptions or learnings into this skill until text is escaped and shared-memory writes are opt-in.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
revenue_tracker.py:1100- Finding
Persistent agent memory poisoning through unsanitized learning entries
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
revenue_tracker.py:432- Finding
Stored HTML injection in generated dashboards and revenue reports
- Content
View full analysis
0 else 0 goals_html += f"""""" ``` It also inserts persisted event descriptions without HTML escaping: ```python events = read_jsonl(EVENTS_FILE)[-10:] events_html = "" for e in reversed(events): a = e.get("amount_eur", 0) color = "#22c55e" if a >= 0 else "#ef4444" sign = "+" if a >= 0 else "" events_html += f""" {e.get('date','—')} {e.get('stream','—')} {e.get('type','—')} {sign}€{abs(a):,.2f} {e.get('description','—')[:40]} """ ``` The HTML report inserts learning categories and insights without escaping: ```python # Learnings HTML learnings_html = "" for l in learnings[-5:]: icon = "✅" if l.get("impact") == "high" else "💡" learnings_html += f"""{g.get('name','—')} {pct:.1f}%{icon} [{l.get('category','—')}] {l.get('insight','')}""" ``` The resulting documents are written as active HTML: ```python report_path.write_text(html, encoding="utf-8") ``` ### Technical Analysis Multiple caller-controlled ...[truncated 2054 chars]- Remediation
View remediation
``` 6. Avoid inline JavaScript and event handlers so that a strict policy can be enforced. 7. Validate and limit the length of descriptions, goal names, categories, and insights at input time. 8. Add regression tests for HTML elements, quoted attributes, event handlers, SVG payloads, and malformed markup in every rendered field. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill text overstates what is implemented and mixes actual writes with claimed external integrations that are only emitted as instructions. This can mislead an autonomous agent into treating printed instructions or local state changes as completed business actions, creating integrity gaps, unsafe follow-on automation, and audit confusion around financial records and alerting.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README explicitly states that after every revenue event the agent will automatically sync data to Google Sheets, Notion, and send Telegram alerts, but it does not warn that sensitive business and financial data may be disclosed to third-party services. In an autonomous-agent context, this increases the chance of silent exfiltration of revenue, customer, and operational information because the agent is instructed to perform external actions by default.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Broad activation guidance increases the chance the skill will be invoked in loosely related contexts, causing financial files, dashboards, and audit artifacts to be updated when not strictly necessary. In autonomous agents, over-broad triggering can become a security and integrity issue because it expands the circumstances under which file-writing and downstream instruction emission occur.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation says learnings are stored in learnings.jsonl, but permissions only authorize LEARNINGS.md. In an agentic environment, this mismatch can cause writes outside declared scope, failed logging, or silent fallback to unintended files, undermining auditability and data-governance controls.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The error-handling section instructs writes to ERRORS.md, but that file is not declared anywhere in permissions. For autonomous systems, undocumented error-log destinations create policy bypass risk, failed writes, or scattered sensitive operational data in unmanaged files.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill writes to shared global files outside its own scoped data directory, including /workspace/AUDIT.md and /workspace/.learnings/*.md. In an agent environment, this creates cross-skill side effects and can overwrite, pollute, or leak operational data into shared logs that other tools or agents may trust or consume.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest's network behavior note clearly says the agent, not the script, sends Telegram alerts and that the script only outputs structured instructions. Later sections describe milestone and anomaly alerts as 'automatic' and say 'the script automatically' checks triggers in daily flow, which blurs or contradicts the earlier statement about responsibility for Telegram actions. This creates intent ambiguity around whether alerting is performed directly or delegated.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger example "show me the revenue dashboard" is a natural-language phrase that could plausibly appear in ordinary conversation, and the section does not define stricter scope such as a command prefix or required context. Because there are no negative examples or invocation constraints, this raises ambiguity about when the dashboard action should fire automatically.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The module Operations documentation says the report command generates an HTML report with a --period selector, implying HTML is the report behavior for that operation. The implementation actually supports two distinct formats via --format, defaulting to console output unless html is explicitly requested.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This code appends to audit/error/event logs and saves JSON state files, but these helper functions do not provide user-facing disclosure at the point of write. While the module docstring describes high-level operations, it does not clearly warn that running commands will automatically persist data under /workspace and .learnings.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Recording an event automatically generates a dashboard update and emits action instructions for external systems such as Google Sheets and Notion. In an autonomous agent setting, those printed instructions may be consumed and executed by the agent without explicit user approval, causing unintended propagation of sensitive business data to third-party services.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The generated dashboard explicitly sets , which imposes an English language locale in user-facing output. There is no indication that users can select another language or that the English-only behavior is a documented, justified regional requirement.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The HTML report template sets , forcing English in a user-facing artifact. The file does not offer localization or an explicit opt-in to English-only output.
- Content
Static analysis
No suspicious patterns detected.