Security audit

personal-finance-tracker

Security checks for vulnerabilities and agentic risk

Overview

This finance skill is not clearly unsafe, but it automatically keeps local usage history and preferences despite saying financial data is not stored.

Review this before installing if you plan to use real financial records. The core finance assistant behavior is understandable, and I found no exfiltration or destructive code, but the automatic local learning feature should be disabled or narrowed unless you are comfortable with persistent notes and preferences being kept in the skill directory.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill is presented as a personal finance assistant, but it also includes a generic self-learning subsystem that records usage history, errors, and user preferences across sessions. That extra persistence is not essential to the advertised finance functionality and increases the risk of collecting or retaining behavioral data users would not expect, especially in a finance context where inputs may be highly sensitive.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The documentation says financial data is only analyzed and not stored, yet later instructs automatic persistence of preferences and usage-derived data to `learned_patterns.json`. In a finance assistant, preferences, error notes, and capability logs can easily contain or reveal sensitive financial context, so this contradiction undermines user expectations and can lead to unintended data retention.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill states it does not store sensitive financial information, but the automatic learning system stores operational history and preferences, which may indirectly encode sensitive information about a user's finances, habits, or goals. In a personal-finance setting, even metadata about repeated actions, categories, or preferences can be privacy-sensitive and exploitable if exposed.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: This file implements a generic cross-skill learning and telemetry component that can operate on arbitrary skill directories under ~/.workbuddy/skills, which exceeds the stated scope of a personal-finance tracker. Even without network exfiltration, broad collection and persistence of operational data across unrelated skills increases privacy risk and creates an unnecessary cross-context data store that could expose sensitive user behavior if accessed by other components or compromised locally.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code stores arbitrary preference key/value pairs and free-form notes, and also records error notes into learned_patterns.json without validation or minimization. In a personal-finance context, such notes and preferences can easily contain highly sensitive financial or personal information, creating a durable local repository of potentially secret data unrelated to core bookkeeping functionality.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill invites users to provide records via uploads/shared data and also documents persistent preference recording, but does not present a clear privacy warning or consent flow. In a personal-finance assistant, this is dangerous because users may disclose highly sensitive spending, debt, or asset information without understanding that related data may be retained locally.

Static analysis

No suspicious patterns detected.