Security audit

Invoice & Expense Categoriser (HMRC)

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed UK tax-expense categorisation helper with no executable code, persistence, or hidden data movement, but users should redact financial records and verify outputs with an accountant.

Install only if you want UK/HMRC Self Assessment expense categorisation. Redact unnecessary bank details and personal data before pasting statements, and treat the output as bookkeeping support rather than professional tax advice, especially for mixed-use, capital, VAT, or borderline items.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The skill instructs the agent to apply tax categorisation rules automatically and 'do not ask the user', which can suppress clarification on ambiguous, mixed-use, or exceptional transactions. In a financial/tax workflow, this creates a real risk of incorrect autonomous decisions being presented as authoritative, potentially leading to misclassification, overstated deductions, or compliance errors.
Content: Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.
md
## Common Categorisation Rules Apply these rules automatically. Do not ask the user — just categorise correctly and note it: ### Never Deductible (Disallowed) - **Client meals and entertaining** — sole traders cannot deduct business entertainment

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The listing explicitly encourages users to paste bank statements, CSVs, and transaction lists, which commonly contain sensitive financial and personal data such as account details, merchant history, names, and addresses. Because there is no warning, minimization guidance, or redaction advice, users may disclose more data than necessary into the agent workflow, increasing privacy, confidentiality, and potential compliance risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The README positions the skill as "UK" and "HMRC-Aligned" and states it uses HMRC categories, but it does not explicitly require or confirm that the user wants UK tax treatment before applying that locale-specific framework. This can violate language/locale policy expectations when a skill imposes a jurisdiction-specific interpretation without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Line L253 instructs the skill to use 'UK English throughout,' which imposes a language/locale requirement on all outputs. The file does not offer the user any language or locale choice or indicate opt-in, so this is a natural-language policy violation under the locale rule.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.