T08 · Insecure Dependencies
Warning
- Location
SKILL.md:77- Finding
Unpinned Dependency Installed into the System Python Environment
- Content
View full analysis
- Remediation
View remediation
Security audit
Plutus — Expense Intelligence
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to perform local expense reporting as advertised, but its installation command modifies the system Python environment with an unpinned dependency and the reports persist financial data on disk.
Install only if you are comfortable with local plaintext expense reports being created in the working directory. Prefer installing dependencies in a virtual environment with pinned versions instead of running the provided system-level pip command, and treat the paid Pro skill/install link as a separate artifact that was not reviewed here.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:400- Finding
Unescaped Transaction Descriptions Permit Rich-Markup and Markdown Injection
- Content
View full analysis
- Remediation
View remediation
str: return ( str(value) .replace("\\", "\\\\") .replace("|", "\\|") .replace("\r", " ") .replace("\n", "
") ) ``` 4. Apply context-appropriate escaping to every externally controlled value included in Rich or Markdown output, including descriptions and configurable currency labels. 5. Consider producing reports through a Markdown-aware serializer rather than manually concatenating table rows. 6. Add tests using descriptions containing Rich tags, pipes, newlines, links, and image syntax to verify that they are rendered as literal text. ]]>
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill writes transaction-derived Markdown and CSV reports to local disk without clearly signaling that side effect in the primary description and behavior summary. Because the input is financial data, silent persistence increases confidentiality risk on shared machines, synced folders, or monitored working directories, and users may expose sensitive spending history longer than intended.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill description and user-facing summary do not clearly warn that sensitive expense data will be saved as report files. This omission can lead users to process financial records assuming ephemeral analysis, when in fact transaction details persist in plaintext local artifacts that may be backed up, indexed, or accessed by other local users.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The SKILL.md security section states 'Runs entirely locally. No data transmitted,' which implies no external communication. However, the documented installation step uses pip3 install rich, which ordinarily contacts package repositories over the network, so the documentation overstates the no-transmission claim.
- Content
Static analysis
No suspicious patterns detected.