Security audit

self-improving-finance

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed local finance-learning logger with optional reminder hooks; the main caution is to keep hooks scoped and avoid recording real financial data.

Install this only for finance workflows where local issue logging is appropriate. Keep hooks project-scoped, start with the activator-only hook, enable PostToolUse only if command-output scanning is acceptable, and never log real account numbers, client names, exact figures, credentials, or raw transcripts. Review any generated skill or promoted procedure before accepting it.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill documentation references network-capable installation and cloning behavior but does not declare permissions or clearly bound that capability. Hidden or undeclared capability expansion is dangerous because users may trust a finance-logging skill while it also enables code acquisition from external sources, increasing supply-chain and unexpected-execution risk.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The stated purpose is finance issue capture, but the skill also injects reminders into agent context, inspects tool output, and scaffolds new skills. This description-behavior mismatch is dangerous because it broadens monitoring and persistence capabilities beyond what a user would reasonably consent to, creating risk of covert data collection or workflow manipulation.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: Although framed as a finance-learning logger, the skill also promotes changes into broader agent and workflow artifacts, which can persist influence outside the original scope. That is dangerous because a domain-specific skill can become a policy-modifying mechanism, enabling privilege creep and unreviewed propagation of instructions into shared control files.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Automatic PostToolUse inspection of command output grants the skill passive visibility into potentially sensitive command results unrelated to finance. Even with cautions not to log raw output, this broader monitoring surface can expose secrets, internal paths, credentials, or business data through pattern matching and advisory logic.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The document states that the scripts 'only output text' and 'don't modify files or run commands,' but the hook configuration explicitly invokes shell commands via command hooks. This mismatch can mislead users into underestimating execution risk and approving hooks that run with the agent's privileges, increasing the chance of unsafe installation or trust decisions.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The script processes potentially sensitive tool output from the CLAUDE_TOOL_OUTPUT environment variable, then emits instructions telling downstream operators to record detected issues in local files such as FINANCE_ISSUES.md and LEARNINGS.md. Even though the script itself does not write to disk, this creates an unsafe data-handling path that contradicts the header comment and can lead to persistence of sensitive financial findings, especially if users follow the guidance too literally or copy excerpts from raw output.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The automatic triggers are based on broad finance keywords and conditions, which can fire in many benign contexts and cause unnecessary logging or monitoring. Overbroad trigger scope is dangerous because it increases accidental capture of sensitive financial discussion and expands the skill's operational footprint beyond intended anomaly cases.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The matcher includes broad terms such as 'close,' 'audit,' and 'budget' that may appear in unrelated prompts, causing the activator script to run in unintended contexts. Because hooks execute automatically on prompt submission, overbroad triggers expand the scope of automatic command execution and may expose sensitive prompt content more often than users expect.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The repeated matcher guidance preserves ambiguous trigger scope while offering no clear exclusions, so users are encouraged to deploy hooks that may activate across mixed-purpose repositories or ordinary conversations. In a hook system that launches commands automatically, unclear trigger boundaries materially increase unintended execution frequency and data exposure risk.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The Codex setup repeats the same broad finance-related trigger phrases, propagating unintended auto-execution risk across another agent environment. Since the skill is designed to capture operational finance issues, accidental triggering can cause unnecessary processing of sensitive financial context or prompt data outside the intended workflow.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: 2. Apply matching rules: quantity within 2% tolerance, price within $X or 1% 3. Route exceptions by type: price variance → procurement, quantity → warehouse, missing GR → receiving 4. Dashboard showing match rate, exception aging, and processing time 5. Auto-approve perfect matches and create payment proposals ### Metadata - Frequency: recurring
Confidence: 85% confidence
Finding: The feature request proposes auto-approving perfect three-way matches and creating payment proposals without explicit human review. In a finance operations skill, this can enable unauthorized or erroneous payments if upstream data, tolerances, vendor master data, goods receipts, or matching logic are manipulated or wrong, making the autonomous decision materially sensitive.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.