Security audit

Akaunting

Security checks for vulnerabilities and agentic risk

Overview

This is a real Akaunting integration, but it handles financial data with insecure HTTP/default-credential setup and includes privileged container patching that users should review before installing.

Review before installing. Use only with a dedicated low-privilege Akaunting account, change all default passwords, bind the service to localhost or protect it behind HTTPS and firewall rules, avoid sending Basic Auth over HTTP, restrict permissions on any credential file, and treat the Docker repair script as an administrator maintenance action that changes application code.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: assets/docker-compose.yml:8
Finding: Deployment Uses Predictable Default Credentials on a Network-Exposed Service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/akaunting.py:36
Finding: Basic Authentication Credentials Can Be Transmitted over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:49
Finding: Plaintext Credential File Is Created Without Enforced Restrictive Permissions
Content: View full analysis
~/.config/akaunting/config.json << EOF { "url": "http://YOUR_IP:8080", "email": "your@email.com", "password": "your-password" } EOF ``` The client loads the stored password directly from that file: ```python CONFIG_PATH = Path.home() / ".config" / "akaunting" / "config.json" # ... if not all(config.values()) and CONFIG_PATH.exists(): with open(CONFIG_PATH) as f: file_config = json.load(f) config.update({k: v for k, v in file_config.items() if v}) ``` ### Technical Analysis The setup instructions store a reusable password in plaintext but do not set a restrictive `umask`, directory mode, or file mode. Consequently, the resulting permissions depend on the user's environment. Under a permissive umask or unusual home-directory configuration, the credential file may be readable by other local users or processes. The client does not inspect the owner or permissions of the configuration file before loading credentials, so it provides no warning when secrets are stored insecurely. Environment variables offered as an alternative are not automatically a complete solution because they may be exposed through process-inspection or debugging facilities. A protected credential store is preferable. ### Attack Path 1. A user follows the setup instructions in an environment with permissive default permissions. 2. The generated configuration file becomes group-readable or world-readable. 3. Another local user or compromised process reads `~/.config/akaunting/config.json`. 4. The attacker extracts the Akaunting email, password, and service URL. 5. The attacker authenticates to the configured Akaunting instance. ### Impact Assessment The ...[truncated 490 chars]
Remediation: View remediation
~/.config/akaunting/config.json <<'EOF' { "url": "https://YOUR_HOST", "email": "your@email.com", "password": "your-password" } EOF chmod 600 ~/.config/akaunting/config.json ``` - In the Python client, verify that the file is owned by the current user and is not accessible by group or other users. - Refuse to load an insecurely permissioned file, or at minimum issue a clear warning. - Prefer an operating-system credential store or secrets manager rather than a plaintext JSON password. - Use a dedicated API account with minimal permissions and rotate credentials if the file may have been exposed. - Ensure error messages and diagnostic output never print the password or Authorization header. ]]>

T08 · Insecure Dependencies

Warning

Location: assets/docker-compose.yml:5
Finding: Unpinned Mutable Container Image Creates a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
@sha256: ``` - Verify the digest against a trusted release source before committing it. - Use an explicit dependency-update process that includes release-note review, vulnerability scanning, and functional testing. - Enable automated container-image scanning in CI. - Where available, verify image signatures or provenance attestations. - Avoid automatic pulls of mutable production tags. - Apply container hardening such as dropping unnecessary Linux capabilities, using a read-only root filesystem where compatible, and restricting outbound network access. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior goes beyond REST API interaction and includes deployment, application patching, and source/configuration modification. This mismatch is dangerous because users may invoke an accounting skill expecting limited API operations, while the skill can perform maintenance or invasive host/container changes that materially expand the attack surface.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The setup instructions expose the service over plain HTTP and later pair that with Basic Auth credentials. This creates a clear risk of credential interception and financial data disclosure via network sniffing or man-in-the-middle attacks, especially if users follow the example on non-local or shared networks.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api.md (reported line 27)May include surrounding context.
GET /api/accounts/{id} # Get single account POST /api/accounts # Create account PUT /api/accounts/{id} # Update account DELETE /api/accounts/{id} # Delete account

text
**Create account:**

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises network, shell, and environment-dependent behavior but does not declare any tool scope or permission boundaries. In an agent setting, this makes the skill harder to constrain and review, increasing the chance of unintended command execution, credential access, or network actions beyond the user's expectations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are broad enough to activate on many ordinary accounting or invoicing conversations. In an agent ecosystem, overbroad routing can cause this skill to handle prompts it should not, leading to unnecessary access to financial systems, credentials, or transaction-creation capabilities.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
akaunting categories
akaunting transactions

Create transactions

akaunting income --amount 100 --category Sales --description "Payment received" akaunting expense --amount 50 --category Other --description "Office supplies"

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation instructs users to store credentials in plaintext config and use HTTP Basic Auth, but provides no warning about local secret exposure, process leakage, or transport risks. Because this skill manages financial data, compromise of these credentials could allow unauthorized access to accounts, transactions, and other sensitive bookkeeping records.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown API reference documents DELETE /api/accounts/{id} as an available operation, but nowhere around the endpoint or elsewhere in the file does it warn that the action may permanently remove account data. For markdown files, destructive or irreversible behaviors should be disclosed so users understand the risk before using the skill or API.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/akaunting.py (reported line 158)May include surrounding context.
python
def cmd_income(args, config): """Create income transaction.""" # Get category ID categories = api_request("GET", "categories", config, params={"search": f"name:{args.category}"}) cat_id = None

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script performs a POST that creates an income transaction immediately from command-line inputs, with no confirmation prompt, dry-run mode, or safety warning before mutating accounting data. In an agent/automation context, this raises the risk of accidental or prompt-induced financial record creation, which can corrupt books or trigger downstream business processes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The expense command issues a POST to create a financial expense record without any user confirmation or review step. For accounting software, unintended expense creation can alter ledgers, misstate reporting, and create audit/compliance issues if triggered erroneously by automation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This file performs local Docker-based file patching and cache clearing inside the Akaunting container, including modifying application PHP source under /var/www/html/app/Providers/Event.php. That behavior is inconsistent with the skill's declared purpose of interacting with Akaunting over REST and creates an unexpected privileged maintenance backdoor that can alter application code and runtime behavior.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill has an unjustified ability to execute arbitrary commands in the Akaunting container despite being presented as a bookkeeping/API integration skill. In context, this mismatch is especially dangerous because users or orchestrators may grant the skill trust appropriate for invoice/accounting actions, not local code execution and application patching.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 83% confidence
Finding: The script executes shell commands inside a Docker container via docker exec ... bash -c, which creates a command-execution capability beyond normal accounting/API operations. Although the current call sites use hardcoded commands rather than direct user input, this still increases attack surface and enables container-side code modification if the script is invoked in the wrong context or later extended unsafely.
Content: Scanner excerpt · scripts/fix_event_listener.py (reported line 23)May include surrounding context.
python
def run_docker(cmd: str) -> tuple[int, str]: """Run command in Docker container.""" result = subprocess.run( ["docker", "exec", CONTAINER_NAME, "bash", "-c", cmd], capture_output=True, text=True

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This manifest sets LOCALE=en-US directly, which imposes a specific language/locale choice in configuration without any indication of user selection or region-specific justification. That matches the policy concern for natural-language locale restrictions when no opt-in is evident.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The item creation command sends a POST to create products/services directly, again without confirmation or warning. While less severe than financial transactions, unauthorized or accidental item creation can still pollute inventory/catalog data and affect invoicing workflows.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tp4

Missing User Warnings

Tool Parameter Abuse

Undeclared Tool Scope

Vague Triggers

Session Persistence

Create transactions

Missing User Warnings

Missing User Warnings

Session Persistence

Missing User Warnings

Missing User Warnings

Description-Behavior Mismatch

Context-Inappropriate Capability

subprocess module call

Vague Triggers

Missing User Warnings

Static analysis