Security audit
Security checks for vulnerabilities and agentic risk
The skill matches a financial transaction enrichment purpose, but it needs review because it handles banking and email-derived data, mutates local financial databases, documents cron automation, and includes unpinned self-update instructions.
Install only if you are comfortable giving this skill access to local banking databases, Plaid tokens, Google/Places keys, possible Gmail receipt content, and scheduled database-changing workflows. Before use, require explicit read-only versus write/sync modes, remove or externalize self-update instructions, pin reviewed versions, clarify Gmail receipt scope, and define retention/consent rules for LLM queues and receipt line items.
The documentation says the skill is not for creating transactions, yet it also describes writing/upserting transaction records and reading Plaid credentials from local secret paths that are not transparently declared. In a banking context, undisclosed secret access plus write behavior can mislead operators about the true trust boundary and lead to unauthorized handling of financial records.
The documentation says the skill is not for creating transactions, yet it also describes writing/upserting transaction records and reading Plaid credentials from local secret paths that are not transparently declared. In a banking context, undisclosed secret access plus write behavior can mislead operators about the true trust boundary and lead to unauthorized handling of financial records.
The documentation says the skill is not for creating transactions, yet it also describes writing/upserting transaction records and reading Plaid credentials from local secret paths that are not transparently declared. In a banking context, undisclosed secret access plus write behavior can mislead operators about the true trust boundary and lead to unauthorized handling of financial records.
The documentation says the skill is not for creating transactions, yet it also describes writing/upserting transaction records and reading Plaid credentials from local secret paths that are not transparently declared. In a banking context, undisclosed secret access plus write behavior can mislead operators about the true trust boundary and lead to unauthorized handling of financial records.
The documentation says the skill is not for creating transactions, yet it also describes writing/upserting transaction records and reading Plaid credentials from local secret paths that are not transparently declared. In a banking context, undisclosed secret access plus write behavior can mislead operators about the true trust boundary and lead to unauthorized handling of financial records.
The skill includes self-update behavior that pulls code from a remote GitHub source into the agent environment. Self-modifying or self-updating skills are dangerous because they can change trusted behavior after review, potentially introducing malicious code, altering permissions, or bypassing security assumptions in a high-sensitivity financial workflow.
Error handling in styx follows a strict never-modify-raw-data policy: if enrichment fails, log the error, mark the record as unresolved, and continue processing.
- **Self-update: untracked files block `git pull`** — `git stash` only stashes tracked files. New (untracked) files in the skill directory will block the merge. Move them aside before pulling, then compare/restore afterward.
- **Self-update: stash pop may conflict** — After pulling, `git stash pop` can produce merge conflicts if both the pulled changes and the stashed changes touch the same lines.
- **`query.py --health-check` does not exist** — Use inline Python to verify DB integrity instead.
- **Raw transaction data is sacred** — Styx never modifies or deletes records in `transactions.db`.
The operational notes around git stash/pull/pop confirm that live code modification is an expected workflow for this skill. In an agent setting, remote code retrieval plus merge/apply behavior can overwrite reviewed logic or reintroduce unsafe changes, creating a strong supply-chain and integrity risk.
Error handling in styx follows a strict never-modify-raw-data policy: if enrichment fails, log the error, mark the record as unresolved, and continue processing.
- **Self-update: untracked files block `git pull`** — `git stash` only stashes tracked files. New (untracked) files in the skill directory will block the merge. Move them aside before pulling, then compare/restore afterward.
- **Self-update: stash pop may conflict** — After pulling, `git stash pop` can produce merge conflicts if both the pulled changes and the stashed changes touch the same lines.
- **`query.py --health-check` does not exist** — Use inline Python to verify DB integrity instead.
- **Raw transaction data is sacred** — Styx never modifies or deletes records in `transactions.db`.
- **Name cleaning is essential** — Plaid transaction names are heavily obfuscated (e.g., `DD *DOORDASH ROYALINDI`, `ABM-350 MISSION GARAGE`). Strip prefixes before matching.
The dedicated Automation/Self-update section explicitly instructs pulling the latest package from GitHub. For a financial-data skill with shell, file-write, and network capabilities, this creates a clear remote code execution and supply-chain pathway if the source repo or transport is compromised.
## Automation
### Self-update
Pull the latest Styx package from GitHub source. Full procedure: `references/self_update.md`.
## Support File Map
Referencing a self_update procedure as normal operation normalizes unsafe autonomous code refresh behavior. In this context, the danger is amplified because the skill also touches databases, secrets paths, cron jobs, and external services, so compromised updates could immediately affect sensitive financial data flows.
## Automation
### Self-update
Pull the latest Styx package from GitHub source. Full procedure: `references/self_update.md`.
## Support File Map
The repeated self-update reference indicates a persistent, documented path for modifying the skill after deployment. Repetition matters because it makes the unsafe behavior easier to trigger and more likely to be considered acceptable in a system processing sensitive financial and email-derived data.
| `references/query-api.md` | Before writing consumer queries |
| `references/enrichment-pipeline.md` | Before running or debugging LLM enrichment |
| `references/styx_universal_enrichment.md` | Before running Google Places enrichment (read FIRST) |
| `references/self_update.md` | Before running self-update |
| `references/cron-gotchas.md` | Before debugging cron enrichment failures |
| `references/verify-bank-alert.md` | Before cross-checking a bank/card email alert against local ledger |
The repeated self-update reference indicates a persistent, documented path for modifying the skill after deployment. Repetition matters because it makes the unsafe behavior easier to trigger and more likely to be considered acceptable in a system processing sensitive financial and email-derived data.
| `references/query-api.md` | Before writing consumer queries |
| `references/enrichment-pipeline.md` | Before running or debugging LLM enrichment |
| `references/styx_universal_enrichment.md` | Before running Google Places enrichment (read FIRST) |
| `references/self_update.md` | Before running self-update |
| `references/cron-gotchas.md` | Before debugging cron enrichment failures |
| `references/verify-bank-alert.md` | Before cross-checking a bank/card email alert against local ledger |
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- **URL**: https://portal.plaid.com — self-serve, no business verification
- **Free tier**: Up to 100 linked accounts for personal use
- **Supports**: 12,000+ institutions including Capital One and Chase
- **Auth**: Plaid Link flow → access token
- **Python SDK**: `plaid-python`
- **Production base URL**: `https://production.plaid.com`
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
### Teller Details (_not used_)
- Free tier = sandbox only, fake banks
- Production requires mTLS (client cert + private key) + user access tokens
- Dashboard is Phoenix LiveView SPA — doesn't render in regular browser tool
- Teller Connect JS requires HTTPS → needs self-signed cert + Cloudflare tunnel or similar
The skill includes self-update instructions that direct an agent or operator to pull and apply the latest code from a remote GitHub branch. This creates a supply-chain and self-modification risk: if the upstream repository or branch is compromised, the agent could ingest and run unreviewed code or altered scripts, including migration logic.
# Styx Self-Update Procedure
## When to run
The rollback instruction uses git reset --hard HEAD~1, a destructive command that can discard local tracked changes without confirmation. In an agent context, this is dangerous because a model or automation following the procedure could irreversibly delete modifications, operational fixes, or forensic evidence in the skill directory.
If an update causes issues:
cd {skill_root} && git reset --hard HEAD~1
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Business name:"""
return prompt
# ── Main enrichment ──────────────────────────────────────────────────────────
The pipeline queues transaction details for downstream LLM processing and persists them to disk without any visible disclosure, consent, or protective control in this code. In the context of bank transaction enrichment, sending or staging raw names, amounts, dates, and categories for model processing materially increases privacy and confidentiality risk.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
print(f"Found {len(redacted)} redacted transactions")
# Get all access tokens
tokens = txn_conn.execute('SELECT access_token FROM plaid_items').fetchall()
# For each token, pull recent transactions
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
print(f"Found {len(redacted)} redacted transactions")
# Get all access tokens
tokens = txn_conn.execute('SELECT access_token FROM plaid_items').fetchall()
# For each token, pull recent transactions
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# ── Plaid helpers ─────────────────────────────────────────────────────────────
def load_env(path):
"""Load environment variables from a .env file."""
env = {}
with open(path) as f:
for line in f:
The skill documents network, shell, filesystem write, and environment/secrets-adjacent behavior but declares no explicit tool/permission scope. In a financial-data skill, that omission is dangerous because it broadens what an agent may attempt to do without clear guardrails, including touching databases, secrets paths, external APIs, and cron-driven automation.
The documentation says Styx is not for email-based consumption scanning, but later instructs it to fetch Gmail content and parse receipts into its database. That contradiction can cause an operator or orchestrator to route sensitive email content into a skill that was assumed not to handle inbox data, expanding data exposure and consent risk.
The trigger phrases are broad enough to match ordinary finance or transaction-related requests, which can cause this skill to activate in contexts the user did not intend. Because the skill handles sensitive financial and email-adjacent data, overbroad routing increases the chance of unnecessary data access or execution of privileged workflows.
Receipt parsing from Gmail and line-item extraction materially expand the skill from transaction storage into email ingestion and detailed purchase surveillance. In a financial context this increases the sensitivity of stored data and may bypass expected separation between banking data and inbox-derived personal information.
The skill documents parsing Gmail receipts and writing detailed purchase data into a database without an explicit warning that highly sensitive email and financial information will be processed and retained. Lack of notice undermines informed consent and increases privacy and compliance risk, especially when combined with cross-skill sharing.