Security audit

账单伙伴

Security checks for vulnerabilities and agentic risk

Overview

This is a local bookkeeping skill that stores and updates financial records in the workspace, with no evidence of network upload, code execution, deception, or privilege escalation.

Install only if you are comfortable keeping personal financial records in this workspace. Review the generated finance-records/ files periodically, and avoid using it in a shared workspace unless everyone with access is allowed to see the data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README advertises automatic bookkeeping, recurring expense ingestion, and monthly report generation over personal financial data without any notice about consent, data storage, retention, sharing, or error risks. Because this skill handles sensitive financial records, missing transparency and confirmation boundaries can lead users to unknowingly authorize persistent collection or automated actions that affect budgeting accuracy and privacy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill name, description, trigger phrases, and all user-facing guidance are written only in Chinese, implying a fixed language/locale for interaction. The file does not offer a language choice or state that the skill is intentionally limited to Chinese-speaking users for a documented regional purpose.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger scope is very broad and ends with an open-ended catch-all phrase, which increases the chance the skill activates on ambiguous finance-related language and performs file reads or writes without sufficiently clear user intent. In a bookkeeping skill that creates and modifies local records, over-triggering can cause unintended ledger changes, privacy exposure of financial data, or accidental initialization workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill does not clearly warn users that it will create, modify, and maintain local financial files in the workspace, even though the workflow explicitly writes configuration, indexes, summaries, and transaction records. Without upfront disclosure, users may unknowingly permit persistent storage of sensitive financial information, creating privacy and integrity risks if the workspace is shared or later accessed by other tools.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file presents all headings, category definitions, and classification rules exclusively in Chinese. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The README is entirely written in Chinese and presents example interactions only in Chinese, which implies a language-specific user experience. There is no indication that users may choose another language or that the Chinese-only scope is intentional and justified by a region-specific requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file contains natural-language instructions and schema descriptions only in Chinese, which can amount to a language/locale policy issue when no user opt-in or alternative language is provided. The file does not state that the schema is intentionally region-specific or limited to Chinese-speaking users.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.