Security audit

Ledger Project Expense Entry

Security checks for vulnerabilities and agentic risk

Overview

This bookkeeping skill is coherent, but it should be reviewed because it can write persistent ledger records from short natural-language messages and uses an unsafe shell-style command template for user-provided fields.

Install only if you want short messages to create local ledger entries. Before using it on real records, require the agent to show the parsed date, amount, currency, description, and tags before writing, and ensure the ledger script is invoked with structured arguments rather than an interpolated shell command. Check that the Asia/Taipei date default is right for you.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:48
Finding: Shell Command Injection Through Unquoted User-Controlled Ledger Fields
Content: View full analysis
\ --amount \ --currency \ --description \ --tags \ --source manual \ --batch manual ``` ### Technical Analysis The skill directs the Agent to construct a shell command by substituting values parsed from natural-language user input into command arguments. The `direction`, `amount`, `currency`, `description`, and `tags` placeholders are not quoted, escaped, or subject to documented strict validation. If the Agent performs direct textual substitution and executes the resulting string through a shell, shell metacharacters contained in an attacker-controlled field can alter command structure. Characters and constructs such as semicolons, command substitutions, pipes, redirections, or logical operators may consequently be interpreted by the shell instead of being passed to the Python script as literal data. The vulnerability is especially relevant to `description` and `tags`, which are expected to contain arbitrary natural-language text. Numeric and enumerated fields also require validation because quoting alone does not guarantee that their values satisfy the intended schema. The referenced `projects/scripts/add_ledger_entry.py` implementation is not present in the audited project, so this finding concerns the unsafe execution pattern documented by the skill. Exploitation requires an Agent or wrapper to convert this template into a shell command through direct interpolation. ### Attack Path 1. An attacker submits an expense message containing shell syntax in a parsed field such as the description or tags. 2. The skill instructs the Agent to map tha ...[truncated 1032 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger description is broad enough to match ordinary conversational phrases such as quick bookkeeping requests or simple 'project + expense' messages, which increases the chance of the skill activating when the user did not intend a persistent ledger write. In this skill's context, that matters because activation can lead directly to appending financial records, so ambiguity raises the risk of unintended data modification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to append to persistent ledger files based on parsed natural-language input without requiring explicit user confirmation at write time. This is dangerous because ambiguous parsing, prompt injection in surrounding context, or accidental invocation can create incorrect or unauthorized financial records that may be hard to detect or unwind.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file hardcodes the default date as today in the Asia/Taipei timezone, which imposes a locale-specific behavior. There is no user choice, opt-in, or documented justification that this skill is limited to a Taiwan-specific context.
Content: No source excerpt is available for this finding.