Client Project Manager

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:35 PM UTC
• Version: 1.0.0

Overview

The skill has a coherent freelance-management purpose, but it asks for unnecessary shell access and stores client, invoice, and payment details as ordinary local files without enough privacy guidance.

Review before installing. Use this only in a private, access-controlled workspace, keep freelance-data/ out of git and shared sync locations, avoid storing bank account numbers, routing numbers, credentials, or tokens, and review generated invoices and updates before sharing. Removing Bash from the allowed tools would better match the documented functionality.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Unnecessary Shell Execution Capability Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5
Vulnerability Type: Excessive tool permissions
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: Read, Write, Edit, Grep, Glob, Bash

Technical Analysis

The skill grants access to Bash, although its documented functionality consists of reading, searching, creating, and updating structured files under ./freelance-data/. None of the documented client-management, invoicing, reporting, or configuration workflows explicitly requires arbitrary shell-command execution.

Granting shell access expands the skill's authority beyond its stated operational requirements. Unlike structured file tools, Bash can execute arbitrary programs, access files outside the intended data directory, modify the local environment, and perform operations using all permissions available to the agent process.

This is a least-privilege violation. It does not establish that malicious commands are currently executed, but it creates an unnecessary command-execution channel that could amplify future prompt injection, unsafe generated commands, or malicious content processed by the skill.

Attack Path

1. An attacker places instruction-like content in a client name, project note, deliverable description, or another field subsequently read by the skill.
2. The skill processes that attacker-controlled content while performing a documented operation such as generating an update or invoice.
3. If the content is interpreted as an instruction, the unnecessary Bash permission provides a path to invoke arbitrary local commands.
4. Those commands execute with the permissions of the agent process and are not inherently restricted to ./freelance-data/.

No direct prompt-injection instruction or shell invocation was found in the audited file; therefore, this path depends on another input-handling failure. Nevertheless, retaining an unnecessary shell capability materially increa ...[truncated 579 chars]

Remediation

View remediation

Remediation Suggestions

• Remove Bash from allowed-tools because no documented workflow requires arbitrary command execution.
• Retain only the structured tools necessary for operation, such as Read, Write, Edit, Grep, and Glob.
• If supported by the host, restrict file operations to the project-controlled ./freelance-data/ directory.
• Treat all client names, notes, descriptions, and imported records as untrusted data rather than executable instructions.
• If shell functionality is added later, expose narrowly scoped operations instead of unrestricted shell access, validate every argument, prohibit command-string interpolation, and require confirmation for operations outside the data directory.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:283

Finding

Potentially Sensitive Payment Information Is Stored in Plaintext

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:283-286
Vulnerability Type: Plaintext storage of sensitive financial configuration
Risk Level: Medium

Vulnerable Code

text

/client-project-manager config --name "Your Name" --business "Your Business LLC" --email "[e-mail]" --payment "PayPal: [e-mail] / Bank: routing XXX"

Save to freelance-data/config.json.

Technical Analysis

The configuration command accepts payment information, including an example bank-routing value, and directs the skill to save it in freelance-data/config.json. The specification does not require encryption, an operating-system secret store, restrictive file permissions, field-level redaction, or exclusion from source control and backups.

Payment instructions can contain personal email addresses, bank-routing information, account identifiers, or other sensitive financial metadata. Storing such values in an ordinary plaintext JSON file makes them readable by any local process or user that can access the project directory. The same configuration is also used when generating invoice content, increasing the number of derived files in which payment details may appear.

The example contains only a placeholder and no hardcoded real credential. The vulnerability arises from the prescribed storage design and the likelihood that users will replace the placeholder with real payment information.

Attack Path

1. A user invokes the config command and supplies real payment information through the --payment argument.
2. The skill writes that value in plaintext to freelance-data/config.json.
3. The file is read by another local user or process, included in a repository commit, copied into an unprotected backup, collected as an artifact, or accessed through another broadly scoped agent tool.
4. The exposed value is used for financial profiling, targeted fraud, phishing, or other misuse.
5. Payment information may addi ...[truncated 627 chars]

Remediation

View remediation

Remediation Suggestions

• Do not store bank account numbers, routing details, credentials, tokens, or comparable secrets directly in config.json.
• Store only non-sensitive payment labels or masked references, such as the payment provider name and the last four digits of an account.
• Keep sensitive values in an operating-system credential manager or dedicated secret store and reference them by identifier.
• Apply restrictive owner-only permissions to configuration and generated invoice files where the operating system supports them.
• Add freelance-data/ to source-control ignore rules and document that the directory must not be committed or uploaded as a public artifact.
• Redact sensitive payment data from logs, command history, dashboards, generated updates, and error messages.
• Warn users that command-line arguments may be retained in shell history; prefer an interactive secret-entry mechanism or secret-store integration.
• Minimize payment details included in invoices to information strictly necessary for payment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly stores client CRM, project, time, invoice, and communication data in local files, but it does not warn the user that this can include sensitive personal and business information. This can lead users to invoke the skill in shared workspaces, synced folders, or less-secure environments without realizing data will be persisted on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invoice and weekly-update features generate Markdown and HTML files containing client names, contact details, billing records, payment methods, and project status, yet the skill provides no warning about the sensitivity of these outputs. Persisting such artifacts increases the chance of unintended disclosure through local access, backups, source control, or synchronization services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.