Security audit

QuickBooks Mileage CSV

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a QuickBooks mileage CSV generator, but it under-discloses optional automatic email delivery of generated reports and attachments through SMTP, Microsoft Graph, or Gmail.

Review this skill before installing. Use it only if you intend to let it process mileage source data and understand that enabling email can send generated CSV/report attachments through the configured mail account to the configured recipient. For local-only use, keep email disabled and verify the output directory and credentials first.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents the skill as a local CSV generator, but the documented behavior indicates optional cloud/email output and the static finding reports mail-sending and external transmission capabilities not disclosed in the description. This mismatch is dangerous because users and reviewers may approve a seemingly local-only skill while it can exfiltrate financial mileage reports, attachments, or metadata to external recipients through SMTP, Microsoft Graph, or Gmail APIs.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill instructs the agent to run a local CLI that reads configuration and generates output files, but the manifest does not declare any explicit tool scope or permissions boundaries. That omission makes the skill's file access less transparent and easier to over-grant in practice, increasing the risk of unintended reads or writes when the agent executes the workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The pipeline conditionally sends email with generated attachments via maybe_send_email, which is a network/transmission action that can expose user or system data. In this file there is no confirmation prompt, print/log statement, or explanatory docstring/comment near the send operation warning the user that results and attachments may be emailed.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest describes this skill as generating QuickBooks Online mileage CSV files from source records using a local CLI and user-owned credentials. This file implements optional email composition and delivery via SMTP, Microsoft Graph, and Gmail APIs, including transmitting generated reports and attachments to external recipients, which goes beyond local CSV generation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: SMTP and cloud email API sending are substantial capabilities that enable external transmission of generated content. Given a stated purpose centered on producing mileage CSV files from Airtable, Outlook, or Google Calendar records using a local CLI, these delivery channels are not an obvious requirement unless expressly declared.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: The function writes a CSV and/or markdown report to disk when not in dry-run mode. While these writes are part of the pipeline behavior, this file does not provide a visible warning, prompt, or user-facing log indicating that files will be created under the configured output directory.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.