T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:22- Finding
Plaintext Storage and Duplication of Sensitive Financial Records
- Content
View full analysis
- Remediation
View remediation
Security audit
Invoice & Expense Tracker
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent local invoice tracker, but users should understand it saves financial records as plaintext files in the current project.
Install only if you are comfortable keeping invoice and expense details in local plaintext files under the working directory. Keep ./data and ./exports out of source control and shared folders, avoid storing account numbers or tax identifiers, and review entries and CSV exports before relying on them for bookkeeping or accounting imports.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README presents very broad natural-language commands such as payments, invoicing, reporting, and export requests without defining clear trigger boundaries, confirmation requirements, or exclusion conditions. In a conversational assistant, this can cause accidental invocation or misinterpretation of ordinary discussion as bookkeeping actions, leading to unintended financial record creation, modification, or export.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill handles sensitive financial data and can generate/export accounting records, but the description does not warn users about privacy, data accuracy, or the risks of exporting records for downstream accounting systems. This omission increases the chance users will supply sensitive business data without understanding retention, exposure, or the need to verify generated records before relying on them for bookkeeping.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill is designed to trigger on very broad natural-language cues like 'spending, paying, receiving, or invoicing,' which can cause it to capture and persist financial information from ordinary conversation without sufficiently explicit user intent. In a finance skill that writes to disk, this increases the risk of unintended ledger entries, privacy issues, and accidental retention of sensitive business data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill stores financial records in local plaintext JSON and exports CSVs, but it does not provide a clear up-front warning at activation time that user financial data will be persistently written to disk. Because this includes vendor names, amounts, dates, and potentially sensitive business records, users may disclose data without realizing it will be retained in unencrypted local files.
- Content
Static analysis
No suspicious patterns detected.