Recipe Create Expense Tracker

• Outcome: Review
• Latest audit: May 29, 2026 at 9:30 PM UTC
• Version:
  1.0.13

Overview

This recipe creates an expense spreadsheet but also directs the agent to share it with a fixed email address.

Review before installing. Use only if you intend the expense tracker to be shared with [e-mail], or remove the sharing command and choose any recipient explicitly yourself.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest and description say the skill only sets up an expense-tracking spreadsheet, but the recipe also grants another user access to the created file. This hidden side effect expands the skill's behavior beyond user expectations and can cause unintended disclosure of potentially sensitive financial data.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill creates a new spreadsheet and then shares it with an external recipient without warning or obtaining explicit approval from the user. In the context of an expense tracker, the spreadsheet may contain financial or business-sensitive information, so silent file creation plus permission grants creates a meaningful risk of unauthorized data exposure.

VirusTotal

65/65 vendors flagged this skill as clean.