Security audit

Client Dashboard

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed finance reporting skill that creates local KPI workbooks and a local cache from QuickBooks data, with some install and data-handling cautions.

Install and run this only in an environment appropriate for client financial data. Use a restricted output directory instead of a synced or shared Desktop when needed, review or clear the CDC cache according to your retention policy, and prefer pinned dependencies or a dedicated virtual environment before running the referenced pipeline.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:43
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
``` 2. Generate and enforce cryptographic hashes, for example through a hash-locked requirements file: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Commit dependency metadata and a lockfile that includes all transitive dependencies. 4. Install dependencies in a dedicated virtual environment rather than the system Python environment. 5. Use an explicitly configured, trusted package index and disable unintended extra indexes to reduce dependency-confusion exposure. 6. Run dependency vulnerability and integrity checks in CI before publishing the skill. 7. Include the referenced pipeline source and `qbo-client` dependency metadata in the reviewed artifact so their credential handling, data access, cache behavior, and input validation can be audited. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly documents writing client financial data to a local Excel file on the user's Desktop and persisting month-over-month KPI snapshots in a local cache, but it does not clearly warn users about the sensitivity, retention, or access implications of those artifacts. In a finance workflow, these files can contain confidential client KPIs and may be exposed to other local users, backups, sync tools, or accidental sharing if users are not informed before execution.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.
md
| File | Path | |------|------| | Pipeline script | `scripts/pipelines/client-dashboard.py` | | Skill file | `skills/client-dashboard/SKILL.md` | | CDC cache | `.cache/client-dashboard/{slug}.json` | | Output (default) | `~/Desktop/KPI_Dashboard_{slug}_{YYYY_MM}.xlsx` |

Static analysis

No suspicious patterns detected.