Norman: Accounting Monthly Reconciliation

• Outcome: Pass
• Latest audit: May 28, 2026 at 2:39 AM UTC
• Version:
  1.0.0

Overview

This skill is a clearly disclosed monthly accounting workflow, but it can make real bookkeeping changes through the Norman Finance integration.

Install this only if you intend to let an agent work with your Norman Finance account for month-end reconciliation. Review each proposed category, verification, invoice match, reminder, attachment link, and tax preview before approving changes or submission.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill description and usage wording are broad enough to match many routine bookkeeping or month-end requests, which can cause the agent to invoke this skill in situations where the user did not intend a full reconciliation workflow. Because the skill performs high-impact financial actions such as verifying transactions, linking invoices, and potentially initiating reminders, overbroad triggering increases the risk of unintended state-changing operations in a sensitive finance context.

VirusTotal

66/66 vendors flagged this skill as clean.