Security audit

self-trust

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed local personal-finance ledger tool, but users should treat its stored data and reminders as sensitive.

Install only if you are comfortable storing a local financial profile under the configured data directory. Enable encryption for sensitive ledgers, prefer a key file or careful passphrase handling over exposing secrets in shell history, and verify inferred categories, planned status, amounts, and pending-request details before confirming ledger-changing actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill explicitly instructs the agent to read reference files, invoke a Python CLI, access environment variables for secrets, and write ledger/audit data, yet no permissions are declared. This creates a capability/expectation mismatch: the platform or user may treat the skill as low-privilege while it is designed to perform shell execution, file I/O, and secret consumption, increasing the risk of unintended code execution and sensitive data exposure.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The document claims ambiguity is resolved deterministically, but later rules explicitly direct the LLM to silently infer categories, planned status, numeric amounts, and request matching. Those inferences can materially alter transaction semantics, approval paths, cooldown bypass behavior, and reporting without explicit user confirmation, creating integrity and auditability risks in a finance workflow.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger list contains very broad consumer-finance terms such as bookkeeping, budget, saving, debt, mortgage, and audit, which are common in ordinary conversations. Because this skill is capable of shell execution and file operations, over-broad activation raises the chance that it will engage in the wrong context, potentially reading or modifying local financial data when the user did not intend to invoke this specific skill.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation explicitly recommends passing encryption secrets via command-line flags or environment variables (`SELFTRUST_PASS` / `SELFTRUST_KEY_FILE`) but does not warn that environment variables and process arguments can be exposed through shell history, process listings, crash dumps, CI logs, or inherited subprocess environments. In a personal-finance skill handling highly sensitive ledger data, this weakens the protection promised by AES-256-GCM because the encryption key material may leak through operational use rather than cryptographic failure.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The rules instruct the assistant to proactively fetch and display pending cooling-period requests at conversation start, which can expose prior financial actions, amounts, categories, and identifiers to anyone with access to the current session context. In a personal-finance skill, that creates a privacy leak and increases the chance of unintended disclosure without an explicit user request or consent gate.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The onboarding flow asks for liquid assets, monthly savings capacity, and long-term goals, all of which are highly sensitive financial data, but it provides no disclosure about storage, retention, processing, or optionality. In a finance skill, collecting this data without transparent notice increases privacy and compliance risk and may lead users to overshare unknowingly.

Ssd 3

Medium

Confidence: 89% confidence
Finding: The interaction rules tell the model to retain, reuse, and prominently render request identifiers with category and amount as memory anchors. This increases exposure of linkable financial metadata in ordinary chat flow and makes sensitive prior actions easier to recover, reference, or disclose accidentally across turns.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:47