Document Ingestion

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:09 AM UTC
• Version: 1.0.2

Overview

The skill is a disclosed accounting document ingestion helper, but users should treat it as handling sensitive financial data and install dependencies cautiously.

Install and run this only in a project where you trust the referenced document-ingestion pipeline. Use a virtual environment or container, pin dependency versions where possible, prefer --no-qbo-coa or --sandbox unless live QBO chart data is needed, and keep QBO tokens and source financial documents in access-controlled locations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:126

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Execution Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 126-136
Vulnerability Type: Unpinned dependency installation from mutable package repositories
Risk Level: Medium

Vulnerable Code Snippet:

bash

### Required (pip)
```bash
pip install openpyxl

Optional (better extraction quality)

bash

pip install pdfminer.six   # Better PDF text extraction
pip install ofxparse       # Better OFX/QFX parsing
brew install tesseract     # Image receipt OCR (JPG/PNG)

text

### Technical Analysis

The Skill instructs the Agent to install third-party packages without fixed versions, cryptographic hashes, or a dependency lockfile. These commands resolve mutable package versions from external repositories at installation time.

Python package installation may execute package-controlled build or installation logic. Homebrew packages and their dependencies also introduce externally maintained executable components. If an upstream package, maintainer account, package repository, or transitive dependency is compromised, following these instructions could execute attacker-controlled code under the privileges of the user running the Agent.

The audit found no evidence that the named packages are currently malicious. The vulnerability is the absence of controls that ensure the installed artifacts are the same reviewed versions on every installation.

### Attack Path

1. An attacker compromises a listed package, one of its transitive dependencies, its maintainer account, or the associated distribution channel.
2. The attacker publishes a malicious package version that is accepted by the unconstrained installation command.
3. The Agent follows `SKILL.md` and runs `pip install` or `brew install`.
4. The package manager retrieves the malicious or compromised release because no version or artifact hash is enforced.
5. Package installation logic or the installed component executes with the invoking user's p
...[truncated 1253 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed, exact version rather than allowing the package manager to select the latest release.
2. Maintain a lockfile that records all transitive dependencies.
3. Require cryptographic hashes for Python artifacts, such as through a hash-locked requirements file and pip install --require-hashes.
4. Install dependencies in an isolated virtual environment or container dedicated to the Skill.
5. Use only explicitly configured, trusted package indexes and disable unexpected supplemental indexes to reduce dependency-confusion exposure.
6. Verify package provenance, release signatures where available, and artifact hashes before updating pinned versions.
7. Apply the same version-control and provenance requirements to system packages installed through Homebrew.
8. Run document processing as a non-privileged account with access limited to required input and output directories.
9. Keep QBO tokens outside document directories and restrict their filesystem permissions.
10. Add an update-review process that scans new dependency versions before changing pins.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly handles highly sensitive financial, tax, payroll, and banking documents and may also fetch live QuickBooks Online Chart of Accounts data, but the user-facing description does not clearly warn about that sensitivity or network/data-access behavior. This can lead operators to invoke the skill without informed consent, proper data-handling precautions, or awareness that live accounting metadata may be accessed, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.