AR Collections

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:19 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed accounts-receivable reporting workflow that uses QBO data and writes local report/cache files as expected for its stated purpose.

Before installing, confirm the QBO client slug and output directory, use a dedicated non-root virtual environment with a pinned `openpyxl` version where possible, and treat the generated workbook plus `.cache/ar-collections/{slug}.json` as sensitive financial/customer data that may need cleanup or retention controls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:138

Finding

Unpinned Python Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 138-143
Vulnerability Type: Unpinned third-party dependency and insufficient supply-chain controls
Risk Level: Medium

bash

## Requirements

```bash
pip install openpyxl
# Node.js QBO client must be auth'd
node bin/qbo info {slug}  # from your QBO integration directory

text

### Technical Analysis

The installation command does not pin `openpyxl` to a reviewed version, verify a package hash, use a lockfile, or constrain the package index. Consequently, the installed code can vary between executions according to the latest available release and the active pip configuration.

Because Python packages execute code when imported and may execute build-related code during installation, a compromised package release, package-index account, configured mirror, or local pip configuration could introduce unauthorized code. The risk is especially relevant here because the documented environment uses an authenticated QBO integration and processes sensitive accounts-receivable information.

The audit did not identify evidence that `openpyxl` itself is malicious. The vulnerability is the absence of controls ensuring that users consistently install a specifically reviewed artifact. The referenced pipeline implementation is not included in the supplied project, so its import behavior and additional dependency controls could not be verified.

### Attack Path

1. An attacker compromises a permitted package release or a package index or mirror used by the target environment.
2. The attacker publishes or serves a modified `openpyxl` artifact under a version accepted by the unrestricted command.
3. A user follows the Skill instructions and runs `pip install openpyxl`.
4. Pip resolves and installs the attacker-controlled artifact because no version or cryptographic hash is enforced.
5. Malicious code executes during installation or when the AR pipeline imports the packa
...[truncated 727 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin openpyxl to a specific, reviewed version rather than resolving the latest release:

   bash

   python3 -m pip install "openpyxl==<reviewed-version>"
   

2. Generate and commit a dependency lockfile containing cryptographic hashes. Enforce hash verification during installation, for example:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Configure an explicitly trusted package index and prevent unexpected user-level pip configuration or unapproved mirrors from changing dependency resolution.
4. Install dependencies in a dedicated, non-privileged virtual environment. Do not run pip as root or with sudo.
5. Review and update pinned dependencies through a controlled process that includes vulnerability scanning, provenance checks, and testing.
6. Include the referenced pipeline and its dependency manifest in the auditable project so all imports, transitive dependencies, and QBO data-handling behavior can be reviewed together.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documentation describes generated outputs and a CDC cache path, but it does not clearly warn users that executing the pipeline will write a workbook to disk and update a persistent cache file. In an agent setting, undocumented filesystem side effects can violate user expectations, cause accidental data retention of financial/customer information, and create compliance or privacy issues if run in sensitive environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.