Security audit

Vehicle Expense Tracker

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but its local file handling and dry-run behavior have real safety gaps that users should review before installing.

Review before installing. Use only trusted vehicle names and category values, avoid formula-like text in spreadsheet fields, and do not rely on --dry-run as side-effect free until the config-write ordering is fixed. Prefer configuring dedicated photo and Excel directories and avoid pointing them at sensitive locations.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: tracker.py:181
Finding: Directory Traversal in Photo Destination Construction
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: tracker.py:220
Finding: Spreadsheet Formula Injection Through Expense Fields
Content: View full analysis
Remediation: View remediation

other

Note

Location: tracker.py:164
Finding: Dry-Run Mode Can Persistently Modify Configuration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill description emphasizes Google Sheets expense tracking, but the documented behavior also includes local config access, local Excel creation, and filesystem-based photo storage. This mismatch can mislead users and automated policy systems about the real data access surface, increasing the chance of over-broad trust and unintended local data exposure or modification.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill performs file read/write operations but does not declare any tool scope or permissions boundary. This creates an authorization transparency gap: an agent or reviewer may assume the skill is limited to benign tracking behavior while it can access and modify local files, including config, photos, and spreadsheets.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest says this skill tracks vehicle expenses in Google Sheets and saves photos. While writing to Google Sheets is expected, dynamically reaching into another skill's codebase to reuse authentication is a broader cross-skill integration capability that is not part of the stated purpose and expands trust to external local code.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The config sets the locale to "en-US", which is a natural-language/locale constraint. In this file there is no indication that the user can opt in to this locale or that the restriction is justified as region-specific behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The string "English (US)" defines a specific locale in natural-language content, and this file provides no indication that users can choose another language or that the US locale is optional. Because SQP-3 applies to all file types and covers forced language/locale behavior, this is a mild policy concern if the skill defaults users into this locale without explicit selection.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.