Security audit

plaid

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent, but it routes Plaid financial credentials and account data through a third-party CLI with weakly documented credential and token protections.

Review the upstream plaid-cli source before installing, prefer sandbox or narrowly scoped Plaid credentials, avoid plaintext config where possible, restrict ~/.plaid-cli permissions, do not print tokens into transcripts or logs, and replace the /tmp cron example with a private per-user state directory if monitoring is used.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:5
Finding: Unreviewed Third-Party CLI Handles Plaid Credentials and Financial Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:17
Finding: Plaintext Plaid Credentials and Tokens Lack Documented Filesystem Protection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:43
Finding: Predictable Shared Temporary Files Permit Symlink and State-Tampering Attacks
Content: View full analysis
--from 2024-01-01 --to 2024-01-31 --output-format json \ | jq -r '.[].transaction_id' | sort > "$next" if [ -f "$state" ]; then comm -13 "$state" "$next"; fi mv "$next" "$state" ``` ### Technical Analysis The monitoring example uses fixed, predictable filenames in the globally shared `/tmp` directory. The shell redirection to `"$next"` follows symbolic links and truncates an existing destination before writing. No private directory is created, exclusive file creation is not used, ownership is not checked, and concurrent invocations are not locked. The risk increases because the Skill recommends cron scheduling. An attacker who can predict execution times may pre-create one of the paths, substitute a symbolic link, race the script, or alter the stored transaction-ID list. Platform protections such as sticky-directory semantics or protected-symlink settings may reduce some variants, but the example cannot rely on those controls being present or correctly configured. ### Attack Path 1. A local attacker identifies that the user periodically runs the documented monitoring command. 2. Before execution, the attacker creates `/tmp/plaid.txids.next` as a symbolic link to a file writable by the victim, or creates and manipulates the predictable state files. 3. The scheduled shell opens `"$next"` through output redirection. 4. If symbolic-link traversal is permitted, the linked target is truncated and overwritten with transaction IDs under the victim's privileges. 5. The final `mv` can replace or corrupt the expected state file. 6. Alternatively, the attacker injects or removes transaction IDs from the state, causing false alerts or suppressing detection of new transactions. ### Impact Asses ...[truncated 492 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.