Spend Pulse

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:48 PM UTC
• Version: 0.1.2

Overview

The skill is coherent, but it needs review because it handles real financial credentials and transaction data through an unpinned external CLI and gives under-scoped instructions for sharing spending details.

Review the CLI package and source before installing, prefer a pinned or verified release, and treat generated spending messages and charts as sensitive financial data. Only send them after confirming the recipient/channel and limiting merchant or transaction details to what the user explicitly wants shared.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned External Financial-Data CLI Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-17
Vulnerability Type: Unpinned and unaudited third-party dependencies
Risk Level: Medium

Vulnerable Code

bash

# Install globally
npm install -g spend-pulse

# Or from source
git clone https://github.com/jbornhorst1524/spend-pulse.git
cd spend-pulse
npm install && npm run build && npm link

Technical Analysis

Both documented installation methods retrieve and execute mutable external code without pinning it to a reviewed package version, immutable commit, or verified integrity digest.

The global npm installation may execute package lifecycle scripts with the user's privileges. The source installation clones the repository's default branch and then runs dependency lifecycle scripts and the project's build process. The effective code can therefore change after this Skill has been reviewed.

The audited project contains only SKILL.md; it does not include the CLI source, dependency manifest, or lockfile. Consequently, the implementation that receives Plaid credentials, handles bank access tokens, processes transactions, and stores local data cannot be verified from this artifact.

Attack Path

1. An attacker compromises the spend-pulse npm package, its publisher account, the referenced GitHub repository, or a transitive dependency.
2. The attacker publishes malicious code or modifies the mutable default branch.
3. A user follows one of the installation commands in SKILL.md.
4. npm lifecycle scripts, dependency installation hooks, or the project's build script execute the modified code locally.
5. The malicious code accesses data available to the user account, potentially including Plaid credentials, bank access tokens, transaction records, and other readable local files.
6. The code may transmit collected information or perform other actions within the installing user's privileges.

Impact Assessment

...[truncated 663 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm package to a specifically reviewed version instead of installing the latest release implicitly.
2. Pin source installations to an immutable, reviewed commit hash or signed release tag.
3. Publish and verify cryptographic checksums or signatures for release artifacts.
4. Include the relevant source, package manifest, and lockfile in the auditable artifact.
5. Use deterministic installation commands such as npm ci with a committed lockfile.
6. Review package lifecycle and build scripts before execution; disable lifecycle scripts where they are unnecessary.
7. Prefer a project-local or isolated installation over global installation.
8. Document the CLI's network destinations, credential handling, keychain access, local file permissions, and financial-data retention behavior.
9. Apply dependency scanning and provenance verification to releases and transitive dependencies.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.

md

**"Plaid credentials not found"**: Run `spend-pulse setup` to configure.

**"Access token not found"**: Run `spend-pulse setup` to re-authenticate.

**"No accounts found"**: Check `spend-pulse link --status` and add account if needed.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to compose and send spending updates, including recent merchants, amounts, and a chart image, but provides no privacy warning, consent check, or guidance to minimize sensitive financial details. In a finance context, this can expose highly sensitive personal transaction data to unintended recipients or channels, especially because the instructions say to 'always include the chart image' and mention notable transactions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.