ezBookkeeping API Tools

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:11 AM UTC
• Version: 1.4.0

Overview

This appears to be a legitimate ezBookkeeping API wrapper, but it should be reviewed because it can modify financial data and manage or revoke login tokens beyond the stated description.

Install only if you intend the agent to query and modify your ezBookkeeping data and potentially administer sessions. Use a dedicated least-privilege token, avoid broad home-directory .env secrets when possible, restrict any token file permissions, and treat tokens-revoke as a sensitive admin action that should only be run with explicit intent.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill exposes shell execution capability through documented script invocation but does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: users or orchestration systems may grant the skill more operational power than expected, increasing the chance of unsafe command execution or unintended local side effects. In this context, the commands are focused on API tooling rather than arbitrary shell payloads, which lowers but does not eliminate the risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose omits several privileged or state-changing capabilities, including session/token management and creation of accounts, categories, and tags. This mismatch is dangerous because users may authorize or invoke the skill expecting limited bookkeeping queries/transaction recording, while the underlying tooling can alter broader application state or affect authentication sessions. Because the skill handles a finance application and API token, hidden administrative actions are especially sensitive.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill exposes token/session management operations (`tokens-list`, `tokens-revoke`) that are outside the manifest’s stated bookkeeping scope. In an agent context, this expands the authority surface from finance-data access to authentication/session administration, enabling unintended session enumeration or revocation if the tool is invoked by a prompt or workflow that assumes only bookkeeping actions are available.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The script exposes write operations for accounts, categories, and tags even though the manifest describes retrieval-focused behavior for those resources. This creates a scope mismatch that can mislead downstream agents or users into granting access under false assumptions, allowing unintended modification of financial metadata.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill advertises bookkeeping operations, but it also exposes session enumeration and token revocation APIs. That materially expands the privilege surface into authentication/session administration, enabling disclosure of active sessions and revocation of tokens unrelated to normal transaction entry or lookup.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: Including token administration capability in a bookkeeping tool violates least privilege and creates an unnecessary path to affect account access state. In the context of an agent skill, this is especially risky because a user may invoke a finance task without realizing the tool can also inspect or revoke sessions.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The manifest says the skill records new transactions and retrieves finance data, but the code also creates accounts, categories, and tags. This scope mismatch increases risk because an agent can mutate financial metadata and bookkeeping structure beyond what the user expects from the declared capability.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation advises placing a long-lived API token in a home-directory .env file without any guidance on file permissions, token scope, rotation, or avoiding accidental exposure. That increases the likelihood of credential leakage through overly permissive filesystem access, backups, shell tooling, or other local processes reading the file. In a self-hosted finance system, token compromise could expose financial records and permit unauthorized state changes.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script exposes destructive and data-modifying operations, including token revocation, without any confirmation prompt, dry-run mode, or safety interlock. In an agent context, accidental invocation or prompt-induced misuse could immediately revoke access or alter bookkeeping data.

Credential Access

High

• Category: Privilege Escalation

Content

fi

    if [ -z "$EBKTOOL_SERVER_BASEURL" ] || [ -z "$EBKTOOL_TOKEN" ]; then
        if load_env_file "$home_dir/.env"; then
            if [ -n "$EBKTOOL_SERVER_BASEURL" ] && [ -n "$EBKTOOL_TOKEN" ]; then
                return 0
            fi

• Confidence: 88% confidence
• Finding: .env"

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.