Security audit

Personal Money Tracker Pro

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local bookkeeping skill, but it can permanently alter financial records without a clear confirmation or undo workflow.

Review this skill before installing if the bookkeeping database matters for records or audits. It is local and purpose-aligned, but ask your agent to preview and confirm any delete, delete-latest, replace, or account-currency update before execution, and keep a backup of the SQLite database if accidental changes would be costly.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs the agent to use environment-variable-driven configuration, including MONEY_TRACKER_DB and LOCAL_BOOKKEEPING_DB, but does not declare an explicit tool scope or permission boundary for environment access. In an agent runtime, undeclared env access can expose sensitive configuration or allow unintended influence over where bookkeeping data is read or written, especially if the runtime injects other secrets into the environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description states the skill is for handling '中文自然语言' bookkeeping requests, which imposes a specific language expectation. There is no accompanying note that other languages may be supported or that Chinese is optional, so this reads as a language constraint without explicit user opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file states that the listed examples are useful as trigger phrases or intent examples for the LLM, but it does not define when these phrases should activate the skill versus when similar everyday chat should not. Because no explicit trigger boundaries, constraints, or negative examples are provided, the activation guidance is ambiguous for a markdown reference file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The command reference documents destructive operations such as deleting entries, categories, accounts, and recurring items without any warning about irreversible data loss or recommendation to require confirmation. In a bookkeeping skill, these commands directly affect financial records, so an agent or user acting on ambiguous input could delete important history unintentionally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The mapping explicitly documents destructive operations like deleting entries, deleting the latest entry, deleting accounts, and deactivating recurring schedules, but it does not mention any confirmation, preview, or undo safeguard. In a natural-language bookkeeping skill, ambiguous user phrasing or routing mistakes can easily trigger irreversible data loss, making this a real safety issue even though it is documented behavior rather than executable code.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file sets default category/account labels in Chinese and later reinforces this with Chinese-only example strings in user-facing help and error messages. This imposes a specific language/locale on all users without opt-in or documented regional justification, which matches the stated locale-policy violation criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The delete-entry command permanently removes ledger records immediately after receiving an ID, with no confirmation gate, dry-run mode, undo mechanism, or soft-delete behavior. In a bookkeeping skill, accidental or prompted misuse can destroy financial records and impair auditability, which is especially risky because agents may execute user intents automatically.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The delete-latest-entry command deletes the most recent transaction directly, without presenting the target entry for confirmation or requiring any explicit acknowledgement. This is dangerous in an agent skill because vague language like 'delete the last one' or parsing mistakes can silently remove the wrong financial record.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The text says the reference keeps useful Chinese prompt examples for skill design and evaluation, and all example prompts are in Chinese. There is no indication that Chinese is optional, user-selected, or justified by a region-specific constraint, which can conflict with language-choice policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The instruction When a user says 记账 : defines activation/classification behavior around a Chinese-language trigger only, without indicating that language choice is optional or that equivalent triggers exist for other locales. This can violate language/locale policy expectations when a skill implicitly constrains usage to one language without documented opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file presents user request examples, routing rules, and command usage entirely through Chinese-language utterances, with no indication that other languages are supported or that the user may choose their preferred language. This can constitute a natural-language policy issue because it effectively forces a specific language without explicit opt-in or justification.
Content: No source excerpt is available for this finding.