Copilot Money Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:04 AM UTC
• Version: 1.1.2

Overview

This skill is coherent for Copilot Money access, but it asks users to install an unpinned unofficial CLI that can read browser session tokens and handle highly sensitive financial data.

Review this carefully before installing. Only use it if you trust the `copilot-money-cli` package and are comfortable letting it access Copilot Money session material from your browser or manual token entry. Prefer an isolated Python environment, verify the package source and version, avoid auto-detection unless needed, and understand how to revoke the Copilot Money session token if you stop using it.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:12

Finding

Unpinned and Unaudited Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–16
Vulnerability Type: Uncontrolled third-party dependency installation
Risk Level: High

Vulnerable Code

markdown

## Install

```bash
pip install copilot-money-cli

text

### Technical Analysis

The skill instructs users to install an unofficial package directly from PyPI without pinning a reviewed version, verifying a cryptographic hash, identifying a trusted publisher, or providing the corresponding source code for audit.

Because no implementation of `copilot-money-cli` is included in the project, the package's actual behavior and the documentation's security claims cannot be independently verified. An unqualified `pip install` resolves the package version at installation time, allowing the effective executable content to change after this skill has been reviewed.

This creates a supply-chain trust boundary around a package that is expected to handle browser session tokens and sensitive personal financial information. A compromised publisher account, malicious future release, or package-name takeover could therefore introduce attacker-controlled code.

### Attack Path

1. An attacker compromises the PyPI publisher account, gains control of the package name, or causes a malicious release to be published.
2. A user follows the skill's installation instructions and runs `pip install copilot-money-cli`.
3. `pip` retrieves the currently resolved package release rather than a version and artifact reviewed with this skill.
4. Attacker-controlled package code executes during installation or when the CLI is invoked.
5. The malicious code can access data available to the user's local account, including any browser data and financial authentication tokens that the user subsequently authorizes the CLI to process.

### Impact Assessment

Exploitation could execute arbitrary code with the privileges of the user running `pip` or the CLI. The potent
...[truncated 393 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specifically reviewed version rather than installing the latest available release.
2. Require installation with cryptographic hashes, such as a hash-locked requirements file using pip --require-hashes.
3. Provide a link to the exact source revision corresponding to the pinned artifact and document the verified publisher identity.
4. Include or vendor the executable implementation in the reviewed project when feasible.
5. Publish reproducible-build or artifact-provenance information so users can verify that the distributed package matches the reviewed source.
6. Run the CLI in an isolated environment with only the minimum filesystem and credential access required.
7. Establish dependency monitoring and require a new security review before updating the pinned release.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:45

Finding

Browser Refresh-Token Extraction and Insufficiently Protected Local Credential Storage

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45–55
Vulnerability Type: Excessive credential access and insecure sensitive-data handling
Risk Level: High

Vulnerable Code

markdown

## Authentication

Config stored at `~/.config/copilot-money/config.json`. The CLI auto-detects your Copilot Money refresh token from supported browsers on macOS.

- Auto-detect: `copilot-money config init`
- Explicit source: `copilot-money config init --source arc|chrome|safari|firefox`
- Manual entry: `copilot-money config init --source manual`

When using browser auto-detection, the CLI reads your browser's local IndexedDB storage to find your Copilot Money session token. This happens locally — no data is sent anywhere except to Copilot Money's API.

Technical Analysis

The documented initialization process accesses browser IndexedDB to locate a reusable Copilot Money refresh token and stores authentication configuration in a JSON file under the user's home directory. Browser session storage and refresh tokens are highly sensitive authentication material.

The documentation does not specify restrictive permissions for config.json, encryption at rest, use of the operating system's credential vault, token redaction requirements, token lifetime, or revocation procedures. It also does not describe a narrowly scoped authorization boundary separating read-only queries from connection-refresh operations.

Accessing browser authentication storage expands the CLI's effective privilege beyond ordinary command execution because it can acquire an existing authenticated session without requiring a purpose-built authorization flow. If the configuration file is broadly readable, backed up insecurely, exposed through support logs, or accessed by another local process, the token may be disclosed.

The statement that no data is sent anywhere except Copilot Money's API cannot be verified from this repository because the CLI im ...[truncated 1448 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace browser-storage extraction with an official OAuth or device-authorization flow that explicitly informs the user of requested permissions.
2. Request narrowly scoped, short-lived credentials and separate read-only financial queries from bank-connection refresh privileges.
3. Make browser access opt-in and display the exact browser profile, credential type, intended use, and storage destination before extraction.
4. Store refresh tokens in the macOS Keychain or the applicable operating system credential manager rather than a plaintext JSON file.
5. If a configuration file remains necessary, exclude credentials from it and enforce owner-only permissions on both the directory and file.
6. Never print tokens in standard output, error messages, debug logs, telemetry, or config show output.
7. Document token expiration, rotation, logout, and immediate revocation procedures.
8. Provide a command that securely removes local credentials and invalidates the server-side token.
9. Publish the CLI source and subject its browser-access, API-request, logging, and credential-storage paths to an independent security review.
10. Clearly distinguish commands that only read data from commands that can alter connection state, and require additional confirmation for the latter.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill advertises broad activation conditions for highly sensitive financial operations, including account queries, transaction history, net worth, holdings, and bank connection refresh. In an agent setting, vague triggers increase the chance of invoking this skill when the user did not explicitly intend to access or sync financial data, creating privacy and integrity risk through over-collection or unintended actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.