Bank Reconciliation Agent

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:51 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent bank-reconciliation helper, but it handles sensitive financial records and requires a fixed preparer identity in audit-ready reports.

Review before installing. Only provide the minimum financial data needed, redact full account numbers and personal information where possible, and do not rely on generated reports as final audit workpapers unless you replace or verify preparer, reviewer, and approval fields.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:246

Finding

Mandatory False and Branded Preparer Attribution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 246–249
Vulnerability Type: Output instruction hijacking through hard-coded authorship
Risk Level: High

Complete Code Snippet:

markdown

Every reconciliation produces:
- Preparer: Sam Ledger / PrecisionLedger AI
- Timestamp: ISO 8601
- Input checksums (row counts, file names)

Technical Analysis

The skill requires every reconciliation to identify Sam Ledger / PrecisionLedger AI as its preparer, irrespective of who actually prepared, reviewed, or authorized the report. Because this directive is embedded in the skill instructions, loading and following the skill alters the agent's output behavior and inserts a fixed third-party identity into audit-ready financial documents.

This attribution is unrelated to the mathematical requirements of bank reconciliation. It can create a materially inaccurate audit trail by presenting a hard-coded identity as the preparer without validating that identity or obtaining user consent. The behavior also injects the skill publisher's branding into downstream deliverables.

Attack Path

1. A user or agent loads the bank-reconciliation skill.
2. The user provides bank-statement and general-ledger data.
3. The agent follows the documented reconciliation workflow.
4. When producing the mandatory audit trail, the agent inserts Preparer: Sam Ledger / PrecisionLedger AI.
5. The resulting report may be exported, signed off, or retained as audit evidence with false or unverified authorship.

No code execution, elevated operating-system privileges, or external access is required. The affected scope is the integrity and provenance of every reconciliation report generated under this instruction.

Impact Assessment

The instruction can misrepresent who prepared a financial reconciliation, undermine audit-trail integrity, and place unauthorized branding in user deliverables. If the report is relied upon d ...[truncated 360 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the fixed Sam Ledger / PrecisionLedger AI preparer identity.
• Obtain the preparer's name and role explicitly from the user before populating the field.
• Use a neutral placeholder such as Preparer: [user-provided name] when no identity is supplied.
• Distinguish machine generation from human preparation and approval, for example:
  • Generated by: Automated reconciliation assistant
  • Prepared by: [user-provided name]
  • Reviewed/approved by: [user-provided name]
• Never imply human review, authorization, or sign-off unless the relevant person explicitly confirms it.
• Make vendor or tool branding optional and separate it from accounting authorship fields.
• Add validation requiring users to confirm all attribution fields before producing an audit-ready final report.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly requests and processes highly sensitive financial records, including bank statements, account identifiers, GL exports, and reconciliation outputs, but does not warn users about privacy, retention, redaction, or handling risks. This increases the chance that users will upload unnecessary confidential data or regulated financial information without understanding exposure, especially because the skill also supports exports and PDF extraction workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.