T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:12- Finding
Overbroad Access to Personal and Cross-Skill Financial Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Tax Professional
Security checks for vulnerabilities and agentic risk
Overview
This tax skill is coherent and not malicious, but it asks for broad personal and financial data access and persistent Telegram reminders without enough consent, scoping, or removal guidance.
Review this skill before installing. It may read your profile and other skill data, store tax and payment records in workspace files, and set up recurring Telegram reminders if those commands are run. Use it only if you are comfortable with that data flow, and avoid storing full confirmation numbers or sending sensitive tax details to shared messaging channels.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T06 · System Persistence
Warning
- Location
SKILL.md:291- Finding
Persistent Telegram Cron Jobs Without Explicit Installation Safeguards
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:93- Finding
Plaintext Storage of Sensitive Tax and Payment Metadata
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The cron examples send tax-related reminders over Telegram, a third-party messaging channel, without warning users that potentially sensitive tax timing and payment information may leave the local environment. Even if the sample messages are brief, they reveal tax status and financial obligations and could be exposed through compromised chat accounts, message previews, or third-party retention.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill directs itself to read USER.md for employment type, location, filing status, and personal context without clearly informing the user that sensitive personal data will be accessed and used. In a multi-skill environment, silent access to profile data creates a privacy boundary issue and can expose more information than is necessary for the immediate task.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs persistent storage of highly sensitive financial and tax data, including expenses, estimated payments, and related records, but does not provide any privacy notice, consent flow, minimization guidance, or retention/security controls. Because tax data can reveal income, business activity, medical spending, and other sensitive personal details, indiscriminate storage materially increases confidentiality and compliance risk if the workspace is accessed by other skills, users, or external systems.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md ## Integration Hooks ### Mechanic Skill Integration When the mechanic skill (`skills/mechanic/SKILL.md`) logs a vehicle service: - If the vehicle has `business_use: true` or a `business_use_percent > 0` in `data/mechanic/state.json`, the maintenance expense is deductible - Deductible amount = cost × business_use_percent (if using actual expense method) - NOT separately deductible if using standard mileage rate (already included in rate)
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - The mechanic skill should suggest logging deductible portions to `data/tax-professional/YYYY-expenses.json` ### Card Optimizer Integration - Purchase categories from `skills/card-optimizer/SKILL.md` can help identify potentially deductible expenses - Business purchase categories: office supplies, software, travel, gas, internet - Cross-reference `data/card-optimizer/cards.json` for spending category analysis
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This document presents tax write-offs as broadly applicable guidance without a clear disclaimer that eligibility depends on tax year, jurisdiction, filing status, substantiation, and individual facts. In a tax-advice skill, users may reasonably rely on these statements and claim deductions they do not qualify for, increasing risk of underpayment, penalties, or audit issues.
- Content
Static analysis
No suspicious patterns detected.