Security audit

Benefits Navigator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a useful benefits guide, but it directs the agent to save and remember sensitive financial, household, medical, and benefits-application details without clear consent or retention controls.

Review this before installing if you would discuss income, dependents, disability, medical documents, benefit applications, denials, or confirmation numbers. Use it only if you are comfortable with the agent creating local files and persistent state, and prefer deleting or minimizing saved trackers after use. Avoid entering full identifiers or unnecessary medical details unless you explicitly need them tracked.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:86
Finding: Plaintext Cross-Session Storage of Sensitive Benefits Data
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:13
Finding: Unpinned Package Execution Through npx Installation Command
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The cross-session state schema stores extensive sensitive data, including household composition, income, dependents, disability-related information, benefits participation, document readiness, and appeal status. Cross-session persistence of this breadth is particularly dangerous because it enables long-term profiling and magnifies harm from any later unauthorized access or secondary use.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The install command invokes an external package via npx clawhub without pinning an exact version, which makes the supply chain mutable over time. If the upstream package is compromised or a breaking version is published, installation could execute attacker-controlled code in the user's environment.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest frames the skill as an informational benefits guide, but the instructions direct the agent to create persistent files containing eligibility results. This scope expansion can cause users or platform reviewers to underestimate that the skill performs data collection and retention, increasing privacy and consent risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to persist eligibility screening results to local files without explicitly warning the user that sensitive household and income data will be stored. Because benefits screening involves financial and household composition data, silent persistence materially increases privacy exposure if the device, workspace, or agent storage is later accessed by others.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill directs persistent storage of sensitive household and eligibility data without clear minimization boundaries. In this context, the skill deals with poverty status, dependents, disability-related circumstances, and income, so collecting and retaining more than is strictly necessary raises significant privacy and profiling risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill adds calendar reminders and ongoing application tracking that are not clearly described in the manifest. This mismatch hides higher-impact behavior involving persistence and time-based automation, which can surprise users and lead to unauthorized handling of sensitive benefit status information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Application tracking and reminder workflows store sensitive information about benefit applications, document status, and deadlines without clear disclosure. This creates a risk of exposing a user's financial hardship, government-benefit participation, and supporting-document state, all of which are sensitive context that could be misused or stigmatizing if disclosed.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions encourage maintaining persistent records of application documents and benefit status details over time. This creates a durable dossier about the user's financial distress and interactions with social-service systems, which is especially sensitive and could facilitate discrimination or identity abuse if exposed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Creating a master tracking document for benefits applications centralizes sensitive personal, financial, and benefits-status data without an explicit storage warning. A single aggregated file increases blast radius because it becomes a high-value target containing multiple programs, deadlines, and identity-related document indicators.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: A benefits navigator primarily needs to provide information and possibly browse authoritative sources. Requiring calendar tooling enables scheduling and persistent follow-up automation, which is a distinct assistant capability not inherent to explaining benefit programs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.