Bs Quick Compare

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 6:16 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed QuickBooks balance sheet reporting workflow, with ordinary dependency and financial-data handling cautions but no artifact-backed malicious behavior.

Install only in an environment where QuickBooks Online access is intended for this reporting task. Keep QBO credentials out of dependency installation contexts, prefer a pinned and reviewed `openpyxl` dependency, and protect or periodically clear the disclosed local cache because it may contain sensitive balance sheet values.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:54

Finding

Unpinned Third-Party Python Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 54-58
Vulnerability Type: Unpinned dependency installation without integrity verification
Risk Level: Medium

Vulnerable Code

markdown

## Requirements

- `pip install openpyxl` (already installed in workspace)
- Node.js QBO client with valid auth token
- QBO credentials configured

Technical Analysis

The documented installation command does not pin openpyxl to a reviewed version, verify package hashes, or specify a trusted package repository. Consequently, the installed artifact can vary over time and may be resolved through a user-controlled or compromised Python package index.

This creates a supply-chain risk if a user follows the installation instruction. A malicious or compromised package artifact could execute installation-time or runtime code with the privileges of the user running pip. The risk is conditional: the file states that the package is already installed, and the audited project contains no script that automatically executes this command.

Attack Path

1. An attacker compromises a package release, configured package mirror, DNS or repository path, or otherwise influences dependency resolution.
2. A user follows the documented pip install openpyxl instruction in an environment where the dependency is absent or being refreshed.
3. pip resolves and installs an artifact without checking an expected version and cryptographic hash.
4. Malicious package code executes during installation or when imported by the referenced pipeline.
5. The code runs with the invoking user's privileges and may access resources available to that process.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user performing the installation or running the pipeline. The affected scope could include files accessible to that user, generated financial reports, local cache data, and ...[truncated 385 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the ad hoc installation command with a reviewed and version-controlled dependency file.
• Pin openpyxl to an explicitly approved version.
• Record cryptographic hashes and require their validation during installation:

  bash

  python3 -m pip install --require-hashes -r requirements.txt
  

• Generate and review the lock file through a controlled dependency-update process.
• Use an explicitly trusted package index, and prevent fallback to unapproved extra indexes or mirrors.
• Run dependency vulnerability and provenance checks in CI before accepting updates.
• Install dependencies in an isolated virtual environment under a non-privileged account.
• Avoid exposing QBO tokens or credentials to package installation processes; provide them only to the pipeline at runtime using a secure secret-management mechanism.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.