Security audit

Plutus Pro — Full Expense Intelligence

Security checks for vulnerabilities and agentic risk

Overview

Plutus Pro is a local expense-analysis skill, but it automatically saves detailed financial reports and recommends a risky system Python install, so users should review it carefully before installing.

Install only if you are comfortable with the skill writing detailed financial reports into the working directory. Use a private folder, avoid shared or synced directories, review generated files before sharing or committing anything, and consider using an isolated Python virtual environment instead of the documented system pip command.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:85
Finding: Unpinned Dependency Installation Into the System Python Environment
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:371
Finding: Sensitive Financial Records Exported to Predictable Plaintext Files
Content: View full analysis
=0 else '')}{fmt(net)} **Tax deductible:** {fmt(tax_total)}\n\n") f.write(f"**Savings rate:** {savings_rate:.1f}%\n\n") f.write("## By Category\n\n| Category | Amount | % | Tax |\n|---|---|---|---|\n") for cat,total in sorted(expenses_only.items(),key=lambda x:-x[1]): pct=total/total_spend*100 if total_spend else 0 f.write(f"| {cat} | {fmt(total)} | {pct:.1f}% | {'✓' if cat in TAX_CATEGORIES else ''} |\n") f.write("\n## All Transactions\n\n| Date | Description | Category | Amount | Tax |\n|---|---|---|---|---|\n") for t in sorted(transactions,key=lambda x:x["date"]): sign="-" if t["amount"]<0 else "" f.write(f"| {t['date'].strftime('%b %d')} | {t['description']} | {t['category']} | {sign}{fmt(t['amount'])} | {'✓' if t.get('tax_deductible') else ''} |\n") with open(csv_path,"w",newline="",encoding="utf-8") as f: writer=csv.writer(f) writer.writerow(["category","total","pct","budget","over_budget","tax_deductible"]) for cat,total in sorted(expenses_only.items(),key=lambda x:-x[1]): pct=total/total_spend*100 if total_spend else 0 bgt=budget.get(cat,0) writer.writerow([cat,f"{total:.2f}",f"{pct:.1f}",f"{bgt:.2f}",f"{max(0,total-bgt):.2f}","yes" if cat in TAX_CATEGORIES else "no"]) with open(json_path,"w",encoding="utf-8") as f: json.dump({"period":slug,"sum ...[truncated 2462 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill exports detailed transaction data, including dates, descriptions, amounts, categories, and tax flags, into markdown, CSV, and JSON files without prominent upfront warning or explicit consent. In a finance context this is highly sensitive information, and persistent local copies materially increase privacy and confidentiality risk, especially on shared machines or synced workspaces.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill presents itself as an expense-analysis tool for CSV/text inputs, but the implementation also writes markdown, CSV, and JSON reports containing potentially sensitive financial data to local disk. That side effect is security-relevant because users may not expect persistent storage of transaction details, which increases exposure to other local users, backup systems, sync tools, or later exfiltration by unrelated software.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest and README-style content describe setup and then say simply 'Run — you're in' without any explicit trigger phrases, invocation constraints, or negative examples. For a markdown skill file, this leaves activation scope ambiguous and could lead to unintended use for loosely related finance requests.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill's stated purpose is wealth/expense analysis, but the documentation and code add a commercial gating capability requiring a paid license key and directing users to purchase links. This is not part of the analytical function itself and is an unrelated capability from the perspective of the skill's declared purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Accessing LICENSE_KEY is not an obvious requirement for expense categorisation, forecasting, tax tagging, or report generation. With no separate declared purpose for authentication or licensing, this environment access is ancillary commercial-control behavior rather than core skill functionality.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.