Tally Prime CA

• Outcome: Review
• Latest audit: May 29, 2026 · 9:40 PM UTC
• Version: 1.0.9

Overview

This is a mostly coherent TallyPrime accounting skill, but it gives an agent broad authority to change live accounting data and install host-level dependencies, so users should review it carefully before use.

Install only in a controlled Tally environment with backups, least-privilege access, and explicit operator approval for every create, alter, setup, import, or cancel action. Pin and preinstall tallyca instead of letting an agent run npm @latest, avoid sudo package installation from agent sessions, restrict TALLY_URL and bridge/tunnel access to trusted endpoints, and minimize full company/account/report exports.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill’s declared purpose is Tally posting/reporting, but the instructions expand its capabilities to generate PDFs from arbitrary user-supplied text via an external CLI. This broadens the effective attack surface beyond the advertised scope and can lead an agent to handle untrusted content through additional tooling, increasing risk of misuse, prompt-to-command bridging, or unsafe file generation workflows.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs the agent to run npm install and upgrade commands at runtime, which effectively grants package-management and code-installation behavior to a business workflow skill. Installing or upgrading packages based on task flow introduces supply-chain risk, environmental drift, and the possibility that an agent modifies the host system in response to untrusted or incidental input.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill includes host-level apt/yum and Playwright dependency installation commands, expanding a Tally integration skill into system administration. That is dangerous because it can cause privileged host changes, widen the blast radius of prompt-driven actions, and normalize OS package installation in response to document-generation failures rather than treating missing dependencies as an environment issue.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The documented scope extends beyond posting/reporting into generic PDF creation and broad master/data modification, materially increasing what the agent is authorized to do. In a financial system context, expanded write capabilities raise the chance of unintended or user-unapproved changes to accounting data and make the skill more dangerous if prompted adversarially or used with weak confirmation controls.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file materially expands the skill from the declared scope of voucher posting/report reading into creating and altering accounting masters, which are high-impact administrative operations. In an accounting automation context, undocumented capability expansion increases the chance of unauthorized or accidental changes to core books, especially if downstream policy, approval, or UI expectations were built around a narrower scope.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The new-company setup section provides bulk GST ledger provisioning and accounting-structure initialization that goes beyond routine voucher posting. This enables large-scale mutation of a company's accounting configuration; if triggered in the wrong company or with incorrect templates, it can corrupt tax setup, misclassify transactions, or create misleading books at scale.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The documentation adds a Stock Summary export path, which broadens the skill from accounting/GST reporting into inventory data access beyond the stated scope. Scope expansion matters for agent security because downstream orchestrators and users may authorize the skill based on the manifest description and not expect inventory data to be retrievable.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file documents company enumeration and company-list export, which exposes metadata about all companies available in a multi-company Tally environment and exceeds the narrower described reporting purpose. In CA and bookkeeping contexts, merely revealing tenant/company names can leak sensitive client relationships and facilitate broader unauthorized data targeting.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The custom TDL-backed report construction enables effectively arbitrary report/collection definition, which is much broader than fixed report export templates and can be used to access unintended data from Tally. In an agent skill, this turns a bounded read interface into a flexible query/programming surface, increasing the risk of unauthorized data extraction and policy bypass.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The bank statement import section materially expands the skill from posting already-structured accounting entries into classifying raw bank transactions and choosing ledgers/voucher types. That creates a broader authority boundary: if upstream extraction, mapping, or prompts are wrong or manipulated, the skill could autonomously generate incorrect receipts, payments, or contra entries and corrupt books at scale.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This documentation provides direct XML templates for creating stock groups, UOMs, stock items, godowns, and item invoices that will modify live accounting and inventory records, but it does not clearly warn operators that these are state-changing actions. In the context of a posting skill for TallyPrime, omission of such warnings increases the chance of accidental or unauthorized data creation, duplicate entries, and integrity issues in financial and stock records.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Exporting the full List of Accounts can disclose sensitive financial structure, customer/vendor names, tax ledgers, and other business metadata without any warning, minimization guidance, or access restriction. In this skill's context, that data may be unnecessary for the immediate task and can increase privacy and confidentiality risk if exposed to logs, prompts, or unauthorized users.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation instructs sending accounting exports over HTTP POST without any warning about the sensitivity of financial data, secure transport expectations, or exposure risks. In practice, this can normalize transmitting company financials to insecure endpoints or local services without prompting users to verify network boundaries, authentication, and logging behavior.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.