Security audit

Accountant

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-built for bookkeeping, but it can persistently change financial records and close or lock periods without requiring explicit user approval first.

Review this before installing if you do not want an agent maintaining local bookkeeping memory automatically. Confirm the entity, period, and write policy up front, and require proposed changes before ledger locks, corrections, deletions, filings, or shared finance/contact/project updates. Do not provide raw credentials, full account numbers, national IDs, or e-file PINs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · memory-template.md (reported line 287)May include surrounding context.

Account Institution Type Last four Currency Ledger account Last reconciled Access reference
Operating checking Mercury bank 4471 USD 1010 2026-06-30 keychain:bank-main
Business card Amex card 1009 USD 2050 2026-06-30 1password:Work/Amex
Stripe Stripe processor — USD 1050 2026-07-15 env:STRIPE_KEY_NAME

text

Account	Institution	Type	Last four	Currency	Ledger account	Last reconciled	Access reference
Operating checking	Mercury	bank	4471	USD	1010	2026-06-30	keychain:bank-main
Business card	Amex	card	1009	USD	2050	2026-06-30	1password:Work/Amex
Stripe	Stripe	processor	—	USD	1050	2026-07-15	env:STRIPE_KEY_NAME

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file explicitly instructs users to create and retain durable audit, controls, and examination artifacts, which are likely to contain sensitive financial, payroll, ownership, tax, and possibly personal data. While the content is operationally legitimate, it omits any guidance on data minimization, access controls, retention, redaction, or secure storage, increasing the risk of unnecessary exposure or mishandling of regulated information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill directs the agent to lock prior periods and make accounting corrections that can materially change bookkeeping state, but it does not require an explicit confirmation or safety check before doing so. In an accounting environment, premature locking or incorrect in-place fixes can prevent legitimate edits, alter financial records, and create downstream reporting or compliance issues.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to write to durable local finance files such as accounts.md, subscriptions.md, and open-items records without any visible requirement to obtain fresh user confirmation before modifying those files. In an accounting context, these edits can change audit-relevant records and create persistent state, so an agent following this guidance could make unintended or unauthorized bookkeeping changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown skill directs the operator to 'write the diagnostic as an artifact,' which is a user-data-affecting behavior. Across the document, it also instructs updates to records like closes/<year>.md, ## Period Status, and other artifacts, but it does not include any explicit warning that the skill produces durable file changes or bookkeeping-related state updates.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.