Security audit

GST + UPI Reconciliation Copilot (India)

Security checks for vulnerabilities and agentic risk

Overview

This GST-UPI reconciliation skill matches its stated purpose, but it has concrete report-safety and reconciliation-integrity issues that users should review before relying on it.

Use this only with trusted GST and UPI exports, write outputs to a private dedicated folder, and treat the generated reports as sensitive financial records. Before using the reports for books, collections, or audit decisions, sanitize CSV outputs for spreadsheet formulas and validate missing statuses plus duplicate or blank invoice numbers.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/reconcile_gst_upi.py:220
Finding: Spreadsheet Formula Injection in Generated CSV Reports
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/reconcile_gst_upi.py:113
Finding: Missing UPI Status Fails Open as a Successful Transaction
Content: View full analysis
List[UpiRow]: out = [] for i, r in enumerate(rows): out.append( UpiRow( idx=i, txn_date=parse_date(r.get("txn_date") or r.get("date") or r.get("transaction_date") or ""), amount=parse_amount(r.get("amount") or r.get("txn_amount") or ""), status=normalize_str(r.get("status") or "success"), txn_id=(r.get("txn_id") or r.get("transaction_id") or "").strip(), utr=(r.get("utr") or r.get("rrn") or "").strip(), payer=(r.get("payer_name") or r.get("payer") or "").strip(), note=(r.get("note") or r.get("description") or r.get("remarks") or "").strip(), ) ) ``` ### Technical Analysis The documented input schema identifies transaction status as required, and the matching policy permits only success-like statuses. However, the implementation replaces a missing or empty status with `"success"`: ```python r.get("status") or "success" ``` This is a fail-open default. A malformed, incomplete, or manipulated transaction without a status can satisfy the successful-status check in `score_match()` and be matched when its amount and date align with an invoice. The script also does not validate the presence of required columns before mapping records. Consequently, a UPI export lacking the entire `status` column can cause every otherwise eligible transaction to be treated as successful. ### Attack Path 1. A UPI CSV is exported incorrectly or deliberately modified to omit the `status` column or leave selected status values empty. 2. The script maps each missing value to `"success"`. 3. An affected row has an amount equal to an invoice total and a date w ...[truncated 831 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/reconcile_gst_upi.py:190
Finding: Duplicate or Empty Invoice Numbers Cause Unmatched GST Rows to Be Omitted
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs the agent to read input CSVs and generate multiple output files, but it does not declare any explicit tool scope or permissions boundary. This creates an authorization ambiguity where a host system may grant broader file read/write access than intended, increasing the risk of accidental access to unrelated financial data or overwriting files in sensitive locations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The invocation description is broad enough to match generic accounting or cashflow-related requests, which can cause the skill to activate in contexts beyond GST-UPI reconciliation. Over-broad activation is risky because it may prompt unnecessary handling of sensitive financial files or cause the wrong workflow to run on unrelated bookkeeping tasks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script writes multiple CSV/JSON files containing sensitive financial and personal data such as invoice totals, customer names, payer names, UTRs, and transaction IDs. In an agent/skill context, creating these files without explicit user notice, output-location controls, masking, or data-minimization increases the risk of unintended local persistence, accidental sharing, or exposure through permissive directories and downstream tooling.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.