Security audit

family-ledger 家庭记账skill

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate local family ledger, but it gives an agent too much room to expose or delete household expense records and includes overly broad local permissions.

Install only if you are comfortable with a local agent reading and changing household expense records. Tighten the trigger phrases to require explicit ledger intent, add a confirmation and backup or undo path before deletion, and avoid enabling the bundled Claude local permissions unless you have reviewed and narrowed them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs the agent to execute a delete operation directly from natural-language input without any confirmation, preview, or safety check. Because deletion is irreversible and the user may reference an ID ambiguously or maliciously, this creates a real risk of unintended data loss through misparsing, prompt injection via user input, or simple operator error.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill grants a shell permission to copy its own SKILL.md into the user's global .claude/commands directory, which alters the local agent command surface without any disclosure or confirmation in this file. That creates persistence-like behavior and can silently install or overwrite a command accessible outside the skill's original directory.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: Allowing `git add *` gives the skill broad authority to stage essentially all matching files in the working tree, which can capture unrelated, sensitive, or generated content without user review. In an agent setting, this is dangerous because it enables accidental or unauthorized preparation of data for commit and later exfiltration through normal developer workflows.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The query trigger uses broad terms like '查看', '记录', '列表', and '最近', which can appear in ordinary conversation and may cause the skill to invoke listing commands unexpectedly. In an assistant setting, ambiguous activation can expose private financial history without the user clearly intending to query the ledger.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Summary triggers such as '汇总', '总计', '统计', and especially '花了多少' are broad and may match casual conversation unrelated to the ledger. This can lead to unintended disclosure of household spending totals or cause the assistant to perform sensitive financial queries without sufficiently explicit consent.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill performs deletion based on a detected '删除'+ID pattern and instructs the agent to execute commands directly, with no confirmation or safety interlock. Because deletion is irreversible or at least destructive to financial records, accidental or misparsed input could remove ledger data and undermine integrity and auditability.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The delete operation permanently removes records immediately based solely on an ID, with no confirmation prompt, soft-delete, backup, or undo capability. In a household finance context, an accidental invocation or mistaken ID can irreversibly destroy bookkeeping data, impacting integrity and auditability.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to execute deletion commands directly based on user input, but provides no confirmation, preview, or safeguard for a destructive action. In an agent setting, ambiguous parsing, prompt injection through user phrasing, or simple user mistakes could cause irreversible ledger record deletion.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.