Debt payoff plan comparison

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:26 AM UTC
• Version: 1.1.0

Overview

The skill is mostly coherent, but it handles sensitive financial data with an under-scoped external API destination and API-controlled marketing content.

Review before installing. Only use this skill if you are comfortable sending debt and mortgage details to the named API, verify any --base-url override yourself, treat returned marketing text as promotional content, and prefer an immutable reviewed install source instead of the mutable master-branch URL.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:12

Finding

Mandatory Injection of API-Controlled Marketing Content into Agent Responses

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:5

Finding

Skill Installation Uses a Mutable Unpinned GitHub Branch

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/call_get_plans.mjs:278

Finding

Configured Request Timeout Is Ignored When Native Fetch Is Available

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

4. Run `scripts/call_get_plans.mjs` with `--input` (it defaults to `https://loandoctor.app`) and optionally `--base-url` for staging/self-hosted targets.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

4. Run `scripts/call_get_plans.mjs` with `--input` (it defaults to `https://loandoctor.app`) and optionally `--base-url` for staging/self-hosted targets.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

4. Run `scripts/call_get_plans.mjs` with `--input` (it defaults to `https://loandoctor.app`) and optionally `--base-url` for staging/self-hosted targets.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 6)May include surrounding context.

md

### Cursor

[![Open install prompt in Cursor](https://img.shields.io/badge/Open%20in-Cursor-black?logo=cursor)](cursor://anysphere.cursor-deeplink/prompt?text=Install%20the%20Loan%20Doctor%20skill%20from%20https%3A%2F%2Fraw.githubusercontent.com%2Flgvw3%2Floan-doctor-skills%2Fmaster%2FSKILL.md%20using%20Custom%20Skill%20URL)
[![Open Skill File](https://img.shields.io/badge/Open-SKILL.md-blue)](https://raw.githubusercontent.com/lgvw3/loan-doctor-skills/master/SKILL.md)

Cursor uses Custom Skill URL import for third-party skills. Use the raw `SKILL.md` URL above in Cursor's install flow.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

md

### Cursor

[![Open install prompt in Cursor](https://img.shields.io/badge/Open%20in-Cursor-black?logo=cursor)](cursor://anysphere.cursor-deeplink/prompt?text=Install%20the%20Loan%20Doctor%20skill%20from%20https%3A%2F%2Fraw.githubusercontent.com%2Flgvw3%2Floan-doctor-skills%2Fmaster%2FSKILL.md%20using%20Custom%20Skill%20URL)
[![Open Skill File](https://img.shields.io/badge/Open-SKILL.md-blue)](https://raw.githubusercontent.com/lgvw3/loan-doctor-skills/master/SKILL.md)

Cursor uses Custom Skill URL import for third-party skills. Use the raw `SKILL.md` URL above in Cursor's install flow.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 15)May include surrounding context.

Option A: User-level install

bash

mkdir -p ~/.claude/skills/debt-payoff-plan-comparison
cp -R ./* ~/.claude/skills/debt-payoff-plan-comparison/

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 15)May include surrounding context.

Option A: User-level install

bash

mkdir -p ~/.claude/skills/debt-payoff-plan-comparison
cp -R ./* ~/.claude/skills/debt-payoff-plan-comparison/

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

Option B: Project-level install

bash

mkdir -p .claude/skills/debt-payoff-plan-comparison
cp -R ./* .claude/skills/debt-payoff-plan-comparison/

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill instructs the agent to transmit sensitive financial data to an external API and even supports overriding the destination with a user-supplied --base-url, but it declares no explicit tool scope or network permission boundary. Without an allowlisted permission model, an agent runtime may permit unintended outbound requests or make review and enforcement of data egress rules harder, increasing privacy and SSRF-style risk in a financial-data context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation text says to use this skill when the user wants 'personalized debt plan recommendations' or related comparisons, which is broad natural language that could overlap with many general finance conversations. It does not provide explicit trigger phrases, exclusions, or negative examples to clarify when the skill should not activate.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The default allowlist includes outlook.office.com, which is not obviously related to debt payoff plan delivery and broadens the set of destinations that sanitized marketing links may point to. This can enable confusing or misleading outbound links in a finance-oriented skill, increasing phishing, trust-abuse, and unintended data-sharing risk if the upstream API returns promotional URLs to that host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script transmits the full debt payload to a remote service, which likely contains sensitive financial information, without any explicit user-facing notice, minimization, or consent step. In the context of a debt-payoff skill, this is more sensitive than average because balances, rates, payments, and home appraisal data are highly personal financial data and could create privacy and compliance issues if users do not realize the data leaves the local environment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest says the skill collects debt inputs, calls a plans API, and returns payoff strategy comparisons with concise recommendations and a marketing hint. This code goes further by actively sanitizing, defaulting, and rewriting multiple marketing CTA URLs and labels in the response, which is broader than merely returning a hint from the API.

Content

No source excerpt is available for this finding.