T06 · System Persistence
Warning
- Location
SKILL.md:281- Finding
Recurring notification jobs are installed without lifecycle or consent safeguards
- Content
View full analysis
- Remediation
View remediation
Security audit
Tax Professional Advance
Security checks for vulnerabilities and agentic risk
Overview
This tax skill is mostly purpose-aligned, but it stores sensitive financial records, reads other skill data, and sets persistent Telegram reminders without enough scoping or lifecycle controls.
Review this skill carefully before installing. Use it only in a private workspace, avoid storing full payment confirmation numbers or unnecessary tax identifiers, confirm before it reads other skills' data, and do not run the Telegram cron setup unless you have verified the recipient and know how to remove the jobs.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:390- Finding
Sensitive tax and payment records are directed to predictable plaintext workspace files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill stores persistent tax expense and estimated payment records, including dates, amounts, categories, schedules, and confirmation details, but does not provide a clear warning that this is sensitive financial data or specify handling safeguards. Persistent storage of detailed tax records increases privacy and security risk if the workspace is accessible to other skills, users, or logs.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill goes beyond passive tax guidance and instructs creation of external Telegram-based cron reminders, which introduces outbound messaging and automation capabilities not necessary for core tax analysis. This expands the skill’s attack surface and can leak sensitive tax-related timing or status information through a third-party channel without explicit consent, minimization, or security controls.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The Telegram reminder setup sends tax-related notifications through an external channel without clearly warning users that financial workflow details may be exposed to a third-party messaging service. Even if the messages are brief, they reveal tax obligations, deadlines, and potentially file paths or payment context, creating avoidable privacy risk.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill instructs access to other skills’ files and data stores such as mechanic and card-optimizer state, broadening data access beyond what a tax advisor minimally needs. Cross-skill reads can expose unrelated financial and behavioral data, violate least-privilege boundaries, and enable unintended aggregation of sensitive information if those files contain more than the tax workflow requires.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md ## Integration Hooks ### Mechanic Skill Integration When the mechanic skill (`skills/mechanic/SKILL.md`) logs a vehicle service: - If the vehicle has `business_use: true` or a `business_use_percent > 0` in `data/mechanic/state.json`, the maintenance expense is deductible - Deductible amount = cost × business_use_percent (if using actual expense method) - NOT separately deductible if using standard mileage rate (already included in rate)
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - The mechanic skill should suggest logging deductible portions to `data/tax-professional-advance/YYYY-expenses.json` ### Card Optimizer Integration - Purchase categories from `skills/card-optimizer/SKILL.md` can help identify potentially deductible expenses - Business purchase categories: office supplies, software, travel, gas, internet - Cross-reference `data/card-optimizer/cards.json` for spending category analysis
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file presents numerous tax deductions in a definitive, checklist-like way without a clear warning that eligibility depends on filing status, substantiation, business use, income limits, itemization, state law, and annual IRS changes. In a tax-advice skill, users may reasonably rely on this content as personalized guidance and incorrectly claim deductions, creating risk of underpayment, penalties, or audit exposure.
- Content
Static analysis
No suspicious patterns detected.