KPI Alert System

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:34 AM UTC
• Version: 1.1.0

Overview

This KPI alert skill is mostly purpose-aligned, but its examples include real-looking external recipients and fixed third-party branding that could misroute confidential financial alerts.

Review and replace every alert destination before use, remove any PrecisionLedger/Sam Ledger branding unless it is intentionally yours, and only enable scheduled alerts after confirming approved recipients and limiting sensitive detail in messages.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:53
• Finding: Hardcoded External Alert Recipients Can Cause Unauthorized Financial Data Disclosure## Vulnerability Details **File Location**: `SKILL.md`, lines 53-60 **Vulnerability Type**: Hardcoded external data recipients **Risk Level**: High ```yaml client: "Acme Corp" alert_channels: - type: telegram target: "@irfan_dm" # or channel ID - type: slack webhook: "https://hooks.slack.com/services/..." - type: email to: "[e-mail]" ``` ### Technical Analysis The copy-ready configuration example contains real-looking Telegram and email destinations instead of unambiguous placeholders. The skill processes commercially sensitive information, including accounts-receivable aging, cash runway, revenue, gross margin, and burn rate. If an agent or user reuses this example without replacing every destination, alerts containing that information could be transmitted to unintended third parties. This is an insecure configuration practice rather than evidence of credential theft or malicious executable code. The Slack webhook is visibly incomplete, but the Telegram username and email address appear operationally plausible and are not clearly marked as values that must be replaced. ### Attack Path 1. A user asks the agent to configure KPI monitoring for a business or client. 2. The agent copies or adapts the example configuration from `SKILL.md`. 3. The embedded Telegram username or email address remains unchanged. 4. The skill retrieves financial metrics from QuickBooks Online, Google Sheets, or CSV exports. 5. A threshold is breached and an alert containing confidential financial information is generated. 6. The alert is delivered to the hardcoded external recipient without the data owner's informed authorization. ### Impact Assessment Successful exploitation or accidental activation does not grant local system privileges. Its scope is unauthorized disclosure of financial KPI data available to the configured monitoring workflow. Depending on the connected source, exposed informat ...[truncated 362 chars]
• Remediation: ## Remediation Suggestions - Replace all real-looking destinations with unmistakable placeholders, such as `YOUR_TELEGRAM_CHAT_ID`, `YOUR_SLACK_WEBHOOK`, and `YOUR_EMAIL_ADDRESS`. - Refuse to send alerts until the user explicitly supplies or confirms each destination. - Display the resolved channel type and destination before enabling delivery or scheduling recurring checks. - Require a test notification containing no financial data before activating production alerts. - Validate destinations against an organization-controlled allowlist where possible. - Store Slack webhooks and similar credentials in a secret manager or environment variable rather than in YAML configuration files. - Add a safe default that disables outbound delivery when any destination is missing, unchanged from an example, or not verified. - Record destination changes and require renewed approval when a configuration is copied between clients.

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:178
• Finding: Fixed Third-Party Attribution Is Injected into User-Facing Alerts## Vulnerability Details **File Location**: `SKILL.md`, lines 178-200 **Vulnerability Type**: Prescribed third-party branding and attribution **Risk Level**: Low ```text 🚨 KPI ALERT — Acme Corp Date: March 15, 2026 🔴 AR 90+ Days: $18,500 → Collections action needed immediately 🟡 Gross Margin: 38% → Below 40% target — review COGS ✅ Cash Runway: 8.2 months ✅ Revenue Growth: +4.2% MoM Run by: Sam Ledger / PrecisionLedger ``` ```json { "attachments": [ { "color": "#ff0000", "title": "🔴 AR 90+ Days — $18,500", "text": "Collections action needed. 90+ day bucket exceeds $15,000 threshold.", "footer": "KPI Alert System | PrecisionLedger", "ts": 1742076000 } ] } ``` ### Technical Analysis The prescribed Telegram and Slack templates insert a named person or organization into user-facing output regardless of who operates the skill. This attribution is not necessary for KPI calculation, threshold evaluation, or alert delivery. An agent following the template may therefore represent independently generated alerts as originating from an unrelated third party. The behavior does not alter system safety controls or grant additional permissions. Its security relevance is limited to output integrity, deceptive attribution, and unwanted promotion. It is classified as instruction hijacking because the skill text directs the agent to add unrelated identity information to the user's requested output. ### Attack Path 1. A user requests a KPI alert or report without requesting external branding. 2. The agent follows the supplied Telegram or Slack formatting template. 3. The generated message includes `Sam Ledger / PrecisionLedger` or the `PrecisionLedger` footer. 4. The message is delivered to internal personnel, clients, or external recipients. 5. Recipients may incorrectly conclude that the named person or organization produced, reviewed, or endorsed t ...[truncated 517 chars]
• Remediation: ## Remediation Suggestions - Remove fixed personal and organizational names from all alert templates. - Replace attribution with optional variables such as `{operator_name}` and `{organization_name}`. - Leave attribution fields empty by default and include them only after explicit user configuration. - Require confirmation before adding branding to externally delivered reports. - Clearly distinguish automated generation from human review; do not imply approval or authorship unless it occurred. - Add template tests that reject undeclared names, email addresses, social handles, and organization-specific branding.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly routes sensitive business financial KPIs through Telegram, Slack, and email, but it does not prominently warn users that these channels may expose confidential financial data to third-party platforms, shared workspaces, or misconfigured recipients. Because the content includes AR aging, runway, margin, and burn-rate data, accidental disclosure could reveal material business health information to unauthorized parties.

Static analysis

No suspicious patterns detected.