Personal Finance Reconciler

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:32 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent local finance tracker, but its HTML report generation can turn imported transaction text into active browser content, so users should review it before installing.

Install only if you are comfortable with a local tool storing your bank transactions in SQLite. Use a virtual environment, import statements only from trusted sources, avoid opening HTML reports generated from untrusted or modified files, and prefer text/JSON reports until the HTML escaping issue is fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/report.py:365

Finding

Stored HTML and Script Injection in Generated Financial Reports

Content

View full analysis

Top Merchants\n \n" html += " \n" for m in report["top_merchants"]: html += f" " html += f"\n" html += "

Merchant	Amount	Transactions
{m['merchant']}	{m['total_formatted']}	{m['count']}

\n" # Largest transactions if report["largest_transactions"]: html += "

Largest Transactions

\n \n" html += " \n" for l in report["largest_transactions"]: html += f" " html += f"\n" html += "

Date	Description	Amount	Category
{l['date']}	{l['description']}	{l['amount_formatted']}	{l['category'] or ''}

\n" ``` ### Technical Analysis Merchant names and transaction descriptions originate from imported CSV or OFX/QFX statements. These values are persisted in SQLite and later interpolated directly into HTML without HTML entity escaping. Because characters such as `<`, `>`, `"`, `'`, and `&` are not escaped, a crafted transaction description can break out of the intended table cell and introduce arbitrary HTML or JavaScript-capable elements. For example, a description containing an image element with an event handler would be emitted as active markup rather than displayed as text. This is a stored injection vulnerability: the malicious value is first saved in the transaction database and can execute later whenever an HTML report containing that transaction is generated and opened. ### Attack Path 1. An attacker creates or modifies a CSV, OFX, or QFX statement containing a transaction description with malicious HTML. 2. T ...[truncated 1221 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/categorize.py:47

Finding

User-Controlled Regular Expressions Permit Denial of Service

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Dependencies Create Supply-Chain Drift

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

python3 scripts/import_csv.py <file_path> [--format chase|bofa|wells_fargo|generic] [--account <name>]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

python3 scripts/import_csv.py <file_path> [--format chase|bofa|wells_fargo|generic] [--account <name>]

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/categorize.py (reported line 26)May include surrounding context.

python

# 1. Custom rules (highest priority)
    for rule in rules_by_type.get("custom", []):
        if rule["pattern"].lower() == desc_lower:
            return rule["category_name"], 1.0

    # 2. Exact keyword match
    for rule in rules_by_type.get("keyword", []):

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/categorize.py (reported line 32)May include surrounding context.

python

# 1. Custom rules (highest priority)
    for rule in rules_by_type.get("custom", []):
        if rule["pattern"].lower() == desc_lower:
            return rule["category_name"], 1.0

    # 2. Exact keyword match
    for rule in rules_by_type.get("keyword", []):

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/categorize.py (reported line 50)May include surrounding context.

python

# 1. Custom rules (highest priority)
    for rule in rules_by_type.get("custom", []):
        if rule["pattern"].lower() == desc_lower:
            return rule["category_name"], 1.0

    # 2. Exact keyword match
    for rule in rules_by_type.get("keyword", []):

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · tests/test_categorize.py (reported line 27)May include surrounding context.

python

rules_by_type[rt] = []
        rules_by_type[rt].append(dict(rule))
    conn.close()
    return rules_by_type


class TestCategorizeTransaction:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill instructs the agent to run local commands, install packages, initialize a database, and use an environment variable override, but it does not declare any explicit tool scope or permissions. That mismatch can cause the agent to invoke broader local execution or environment access than a user would reasonably expect, increasing the risk of unauthorized command execution or unintended exposure of local filesystem and environment data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The onboarding trigger includes broad phrases like 'get started' and 'what can you do', which can match benign general conversation and cause the skill to pivot into finance-specific workflow unexpectedly. In this skill, that can lead the agent to solicit sensitive financial documents or file paths when the user may only be asking for generic help, increasing the chance of inappropriate data collection or user confusion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The delete_budget function executes a DELETE statement and commits the change, but there is no confirmation prompt or user-facing warning before performing this destructive operation. Although the docstring names the action, the code does not disclose the irreversible effect at execution time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code updates category assignments for every selected transaction and commits the changes, which is a file-backed data modification with potentially broad impact. Although the script purpose is categorization, there is no visible prompt, print/log disclosure, or inline warning around the bulk write operation to inform users that existing transaction records will be modified, especially when recategorization is enabled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This CLI prints the full query result JSON directly to stdout, and list/max/min queries can include sensitive transaction details such as dates, descriptions, merchants, categories, and amounts. In a personal-finance skill, stdout may be captured by shell history tooling, terminal logs, parent processes, CI runners, or other local observability mechanisms, creating unintended disclosure of private financial data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code generates a full HTML report containing transaction descriptions, spending totals, top merchants, and budget data, which are sensitive personal financial details. The file includes no confirmation prompt, warning message, or explicit disclosure that exporting in HTML may create a persistent, shareable artifact containing private data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The generated HTML explicitly sets lang="en", forcing English as the document language. There is no user choice or documented justification for this locale restriction, which conflicts with the policy against imposing a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The CSV contains natural-language content such as U.S.-specific place names and transaction descriptors like "DIRECT DEPOSIT" and merchant locations (e.g. OAKLAND CA, SAN FRAN CA, OAK PARK IL). Because SQP-3 applies to all file types and covers locale/language policy, this file hard-codes a specific locale context without any opt-in or justification visible in the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.