Payroll GL Reconciliation

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:42 AM UTC
• Version: 1.0.0

Overview

The skill’s payroll reconciliation purpose is coherent, but it handles highly sensitive payroll data with limited handling guidance and hard-codes a third-party preparer name into audit workpapers.

Review this skill before use with real payroll data. Only process payroll exports in an approved secure workspace, avoid putting raw employee payroll data into logs or unnecessary prompts, remove or replace the hard-coded preparer name before generating client workpapers, and treat generated journal entries as drafts that require review before posting.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:529

Finding

Hard-Coded Third-Party Identity in Generated Audit Workpapers

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:529
Vulnerability Type: Output attribution and skill instruction manipulation
Risk Level: Low

python

**Prepared by:** Sam Ledger / PrecisionLedger

Technical Analysis

The workpaper-generation template unconditionally attributes generated payroll reconciliation reports to Sam Ledger / PrecisionLedger. This identity is hard-coded rather than obtained from an authenticated user, an explicit prepared_by parameter, or confirmed engagement metadata.

When an agent follows the skill, this instruction alters the content of the requested deliverable by inserting an unrelated third-party identity. The resulting report can therefore misrepresent who performed or reviewed the reconciliation. This is classified as skill instruction hijacking because the loaded skill silently imposes an attribution that is not necessary for payroll reconciliation and may conflict with the user's intended authorship.

No evidence indicates that this instruction grants system privileges, executes code, transmits information, accesses credentials, or establishes persistence.

Attack Path

1. A user loads the skill and requests a payroll reconciliation workpaper.
2. The agent follows the documented generate_workpaper() template.
3. The template inserts Sam Ledger / PrecisionLedger into the Prepared by field without user confirmation.
4. The generated document is saved, distributed, or retained as audit evidence.
5. Recipients may incorrectly conclude that the named person or organization prepared the workpaper.

Impact Assessment

The issue affects the integrity and provenance of generated accounting workpapers. It could result in false professional attribution, inaccurate audit records, reviewer confusion, or compliance and accountability concerns.

The attainable scope is limited to generated document content. The instruction does not provide filesystem privileges ...[truncated 149 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the hard-coded Sam Ledger / PrecisionLedger attribution from the workpaper template.
2. Add an explicit prepared_by parameter to generate_workpaper().
3. Leave the preparer field blank or label it Not specified when the caller does not provide a value.
4. Require user confirmation before inserting the name of any person or organization.
5. Keep author metadata for the skill separate from authorship metadata in generated client documents.
6. Add a test verifying that generated workpapers never contain an unrequested person or organization name.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill handles payroll exports containing highly sensitive employee and financial data, including names, compensation, tax withholdings, and benefits deductions, but it does not provide privacy, minimization, or storage/handling warnings. In practice, this can lead operators or downstream agents to process full payroll files insecurely, over-share them, or retain them longer than necessary, increasing confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The manifest and overview present the skill as reconciling payroll to the GL and automating journal entry creation, but the explicit NOT-for section says actual QuickBooks data entry should be handled by another skill. The embedded code aligns with producing journal entries and workpapers only, so the mismatch is in the skill's own documentation scope rather than hidden code behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.