Small CPA Firm

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:00 AM UTC
• Version: 2.0.0

Overview

The skill is a coherent CPA-practice assistant, but it normalizes collecting highly sensitive tax and identity documents through ordinary email without adequate safeguards.

Review before installing. Use this only with a secure client portal or encrypted file-exchange process, remove the ordinary email attachment option, avoid collecting SSNs unless legally necessary, and add clear retention, access-control, and deletion rules for tax, BOI, banking, and identity records.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/document-request-templates.md:46

Finding

Sensitive Tax Documents May Be Transmitted Through Insecure Email Attachments

Content

View full analysis

Vulnerability Details

File Location: references/document-request-templates.md, line 46
Vulnerability Type: Insecure transmission and handling of sensitive client information
Risk Level: Medium

Vulnerable Code Snippet:

text

Please upload documents to [portal link] or reply to this email with attachments.

Technical Analysis

The document-request template permits clients to submit tax records through ordinary email attachments. The requested records include W-2 forms, prior tax returns, bank statements, investment records, IRS correspondence, and other sensitive financial documents. The same file also requests beneficiary names, Social Security numbers, and addresses in the trust-return workflow.

Ordinary email does not provide the access controls, recipient validation, end-to-end protection, auditability, or controlled retention normally expected for tax and identity records. Although mail transport may use opportunistic TLS, this does not protect documents after delivery or prevent exposure through mailbox compromise, forwarding, account sharing, synchronization to unmanaged devices, or recipient-address mistakes.

Attack Path

1. The Skill generates a document-request message using the supplied template.
2. A client follows the instruction allowing documents to be returned as email attachments.
3. The client attaches tax forms or other records containing identity, banking, or financial information.
4. The message is delivered to an incorrect recipient, retained in an inadequately protected mailbox, synchronized to an unmanaged endpoint, or accessed through a compromised email account.
5. An unauthorized party obtains and uses the exposed records.

This issue does not grant operating-system privileges or code-execution capabilities. Exploitation depends on access to the email delivery or storage path.

Impact Assessment

The affected scope is the confidentiality of client tax, ide ...[truncated 476 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the instruction permitting clients to reply with sensitive documents as ordinary email attachments.
• Require submission through a firm-approved, authenticated, and encrypted client portal.
• Add an explicit warning not to email Social Security numbers, tax forms, banking records, identity documents, passwords, or portal credentials.
• Require multifactor authentication and least-privilege access for the document portal.
• Validate the portal link and recipient identity before sending each request.
• Enable encryption at rest and in transit, access logging, download controls, and alerts for suspicious access.
• Establish documented retention and secure-deletion periods for uploaded records.
• If exceptional email delivery is unavoidable, use an approved encrypted-message service or separately encrypted attachment with the decryption secret delivered through an independent channel.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The trust template requests beneficiary names, SSNs, and addresses but provides no warning about the extreme sensitivity of that data or how it must be transmitted securely. SSNs are high-value identity data, and in a tax-preparation workflow this omission materially raises the chance that staff or clients will exchange beneficiary PII over insecure channels, leading to identity theft, privacy violations, and regulatory exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly automates client-facing document request emails and reminders in a tax/accounting context, which inherently involves highly sensitive financial and tax data. Without any warning or guidance on secure handling, redaction, approved channels, or data minimization, users may deploy workflows that expose taxpayer information through insecure email, over-collection, or unintended disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill tracks entity compliance data including BOI reporting, registered agent details, and other sensitive ownership/compliance records, but provides no warning about the sensitivity of this information or safeguards for storing and processing it. In a CPA-firm setting, this omission can lead to centralized collection of beneficial ownership and entity data without access restrictions, secure storage requirements, or jurisdiction-specific privacy controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The template explicitly tells clients they may 'reply to this email with attachments' for tax records, which commonly include W-2s, 1099s, prior returns, IRS correspondence, and other highly sensitive financial and identity data. In a CPA-firm context, normalizing email transmission without a security warning or directing users to a secure portal increases the risk of interception, mailbox compromise, accidental forwarding, and retention of sensitive documents in insecure systems.

Content

No source excerpt is available for this finding.