Bkash-Nagad-Tracker

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:36 AM UTC
• Version: 1.0.0

Overview

The skill is a plausible expense tracker, but it needs Review because it handles financial data with unsafe shell command templates, automatic digests, and inaccurate disclosure about Anthropic API data sharing.

Review carefully before installing. This skill should be acceptable only after the publisher replaces shell-string command templates with argument-array execution, gives explicit opt-in for Anthropic parsing and digest generation, removes local-only privacy claims, adds a local-only mode, and documents storage, deletion, heartbeat disablement, and data retention behavior.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:79

Finding

Shell Command Injection Through User-Controlled Transaction Fields

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: README.md:120

Finding

Financial Data Is Transmitted Externally Despite Local-Only Privacy Claims

Content

View full analysis

, "method": <"bkash" | "nagad" | "rocket" | "cash" | "other">, "category": <"food" | "transport" | "rent" | "utilities" | "remittance" | "medical" | "education" | "shopping" | "other">, "note": <2-4 word description in English>, "confidence": <"high" | "low"> }} Rules: - Bengali numerals: ০=0 ১=1 ২=2 ৩=3 ৪=4 ৫=5 ৬=6 ৭=7 ৮=8 ৯=9 - Bengali words: টাকা/তাকা=taka, বিকাশ=bkash, নগদ=nagad, রকেট=rocket - "sent to mum/dad/bhai/apa/family/মা/বাবা/ভাই/আপা" = remittance - "rickshaw/CNG/bus/train/Uber/রিকশা/ভাড়া" = transport - "বাজার/grocery/super shop" = shopping or food - "bill/বিল" with electricity/gas/water/internet = utilities - Default method to "bkash" if unclear - Set confidence "low" if amount is ambiguous or category unclear - Return null for amount if no number found anywhere """ response = client.messages. ...[truncated 3502 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill description presents a simple local expense tracker, but the detected behavior includes undeclared external API usage via ANTHROPIC_API_KEY and incomplete/possibly unimplemented digest/storage behavior. In context, users may disclose highly sensitive financial activity assuming local processing, while their messages could be transmitted to a third party without clear disclosure or permission.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README defines logging behavior as triggered by "Any expense message," which is overly broad for a chat-based skill handling free-form conversation. In practice, this can cause unintended financial records to be created from ambiguous messages, quoted text, forwarded content, or casual discussion, reducing integrity of the user's transaction history and potentially leaking sensitive text into local records or downstream LLM parsing.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes local Python scripts, writes transaction data, and accesses an API key, but it declares no explicit tool scope or permission boundaries. That creates an authorization gap: the runtime may grant broader shell, file, or env access than users or reviewers expect, which is risky for a finance-related skill handling sensitive spending data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation rules match on generic amounts, common verbs, and ordinary spending-related words in both English and Bengali, making accidental triggering likely. In a financial logging skill, false activation can silently capture unrelated chat content as transaction records or route sensitive user text into parser tooling, increasing privacy and integrity risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The heartbeat sends weekly spending digests proactively, with no warning, consent flow, or privacy controls. Because the content concerns personal financial transactions, unsolicited summaries could expose sensitive data to anyone viewing notifications or shared devices, and the risk is elevated by the Bangladesh-focused consumer-finance context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This skill stores sensitive personal financial transaction history in plaintext JSON on local disk without any explicit warning, consent prompt, or mention of retention/security at the point of use. On shared devices, compromised user accounts, backups, or overly permissive filesystem settings, this can expose spending habits, notes, and payment method metadata to other local users or software.

Content

No source excerpt is available for this finding.

Tainted flow: 'TRANSACTIONS_FILE' from os.environ.get (line 20, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · logger.py (reported line 46)May include surrounding context.

python

def save(transactions: list):
    ensure_storage()
    with open(TRANSACTIONS_FILE, "w", encoding="utf-8") as f:
        json.dump(transactions, f, indent=2, ensure_ascii=False)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code transmits full user transaction messages to Anthropic via client.messages.create, which is a real third-party data exfiltration path. For a finance-related skill handling spending, remittance, and payment details, this can expose sensitive personal and financial information beyond what users would reasonably expect from a local transaction logger.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The parser sends raw transaction text to an external API without any disclosure or warning in the code path, so users may unknowingly share sensitive financial content with a third party. In this skill context, messages may contain spending habits, family remittances, amounts, and payment methods, making undisclosed sharing more privacy-sensitive than in a generic chatbot.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · summarizer.py (reported line 26)May include surrounding context.

python

def get_stats() -> dict:
    """Get this week's stats from logger"""
    result = subprocess.run(
        ["python3", str(LOGGER), "stats"],
        capture_output=True, text=True
    )

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The weekly digest sends transaction-derived spending data, including totals, categories, and payment methods, to Anthropic's external API. For a finance-tracking skill, this is sensitive behavioral data exfiltration to a third party, and the metadata/description does not clearly disclose that summaries are processed remotely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Weekly spending data is transmitted to an external model without any in-code user notice, consent flow, or warning. In the context of a Bangladesh-focused expense tracker handling financial habits and payment-method breakdowns, undisclosed outbound sharing is more sensitive and can violate user expectations around local bookkeeping.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

A Bangladesh-focused transaction tracker and weekly digest skill does not inherently require access to environment-managed credentials unless external services are part of the declared scope. This code depends on ANTHROPIC_API_KEY, revealing an undeclared integration capability beyond straightforward local tracking and reporting.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.