Security audit

Mikhay 记账 - 资产管理/信用卡/预购清单/年月统计

Security checks for vulnerabilities and agentic risk

Overview

This is a local Chinese personal accounting skill whose sensitive file access and ledger-writing behavior are disclosed and aligned with its purpose.

Install only if you want a Chinese-local-ledger workflow and are comfortable letting the agent read and update the ledger files you point it at. Back up data/ before using --overwrite, review generated ledger changes, and prefer a pinned or otherwise trusted install path instead of blindly running unpinned npx commands.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (29)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The README instructs users to run npx skills add MikhayEeer/mikhay-accounting-skill without pinning the version of the skills package or otherwise constraining what code npx resolves and executes. If the upstream package changes, is typo-squatted, or a dependency is compromised, users may execute unexpected code during installation, which is especially relevant for a local-file accounting skill that handles sensitive financial data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The text says the skill is a Chinese personal ledger workflow and explicitly states that agent instructions stay in Chinese in SKILL.md. This indicates a fixed language behavior without offering the user a language or locale choice, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The text states the skill is '面向中文个人账本' and presents the operational instructions as Chinese-facing, which is a natural-language locale constraint. Under the policy, forcing a specific language without user opt-in can be a violation unless the restriction is clearly justified as region-specific; this README does not provide that justification or an opt-in choice.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill explicitly instructs reading and writing local files under data/, raw/, and exports/, and discusses overwrite behavior, but it does not declare any explicit tool scope or allowed-tools/permissions boundaries. That mismatch increases the chance an agent can invoke broader file capabilities than intended, leading to accidental modification, replacement, or exposure of local accounting data if the runtime grants default file access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description uses broad trigger language such as import, export, record, classify, validate, summarize, store, and analyze records, which can overlap with many ordinary accounting, spreadsheet, or note-management requests. This can cause over-invocation of a file-writing skill in contexts the user did not specifically intend, increasing the risk of unnecessary access to sensitive financial files or unintended ledger modifications.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The account names and operational terms are presented entirely in Chinese, and the file does not indicate that language choice is optional or configurable. This can violate a language/locale policy when a skill assumes a specific language without explicit user opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file defines all category and rule values exclusively in Chinese, including required enum values such as 类别=收入 and aliases to normalize. This imposes a specific language/locale convention without offering opt-in, alternatives, or documenting that the skill is intentionally region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The entire skill specification, examples, commands context, and expected reply are written only in Chinese, including the mandated reply text in L73. There is no indication that the user may choose another language or that the skill is intentionally limited to a Chinese-only regional/compliance context, which creates a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file presents all operational guidance, warnings, and instructions only in Chinese. Under the policy rule, forcing a specific language without user opt-in or a documented locale-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file consistently specifies prompts, outputs, and operational instructions only in Chinese, which can amount to forcing a specific language or locale. There is no indication that users may choose another language or that the Chinese-only behavior is an explicitly justified regional constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document states 'Primary format: Chinese CSV or JSON,' which imposes a Chinese-language schema as the default format. This is a natural-language locale constraint without any mention of user choice, opt-in, or a documented region-specific justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code hard-codes Chinese-language descriptions, headings, and data-field keys throughout the script, including user-facing output such as section titles and status labels. Because the file provides no opt-in, language selection, or justification that the skill is intentionally region-specific, it creates a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python file contains multiple user-facing strings and data labels in Chinese, including default category names, transaction-type comparisons, CLI output, and headings. Because the skill does not offer any language or locale selection, it forces a specific language without user opt-in, which matches the stated natural-language policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file hard-codes Chinese keys such as 名称, 预计金额, and status values like 想买, and the listed outputs are also in Chinese. This imposes a specific language/locale without user opt-in or an explicit statement that the skill is intended only for Chinese-language workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file states that the skill will analyze recent ledger surplus, net assets, debt, and repayment reminders, and shows a command consuming ledger and asset files. Because this behavior processes potentially sensitive financial data, the description should include a clear user warning about handling personal financial information.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Line L17 explicitly says 'SKILL.md stays Chinese', which is a natural-language locale constraint. In the absence of user choice or a documented region-specific justification in this file, that can violate the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The handoff text states that the skill is "for Chinese personal ledgers," which is a natural-language locale restriction. The file does not indicate any user choice, opt-in, or justification that would clarify whether this regional constraint is required or optional.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The natural-language description states that the skill is for a "Chinese ledger" and for importing/exporting "Chinese CSV/XLSX/JSON ledgers" without indicating that this locale is optional or user-selectable. This can violate language/locale policy if the skill constrains usage to a specific locale without documenting user choice or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This JSON file uses Chinese field names and note values throughout, which imposes a specific language/locale in the skill data format. Under the policy, locale-specific language should either offer user choice or be clearly documented as region-specific, neither of which is evident in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This JSON file is a sample data file, but it consistently encodes keys and content in Chinese, such as 时间, 收支类型, 类别, and 状态. Under the language/locale policy rule, forcing a single locale without user choice or an explicit region-specific justification can be considered a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This manifest/sample data is entirely localized in Chinese for key user-facing fields such as item names, categories, status, and frequency. Because the file provides no indication that Chinese is optional, user-selected, or justified as a region-specific example, it may violate the policy against forcing a specific language without opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The trigger example explicitly instructs the agent to append an item to data/wishlist/YYYY/wishlist.json but does not tell the agent to warn the user that local data will be modified or to confirm the write. In this skill, the action is local-only and user-initiated, so the risk is limited, but silent file modification can still cause unintended persistence or overwrite/duplication issues.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill uses Chinese-only field names, status values, and user-facing output strings throughout the file, which effectively forces a specific language/locale. There is no opt-in, alternate language support, or documentation in this file explaining that the tool is intentionally limited to a Chinese-language context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.