Security audit
Security checks for vulnerabilities and agentic risk
This skill reads finance data to generate an expense report, and the requested access is disclosed and aligned with that purpose.
Install this only if you intend the agent to read Norman Finance transaction data and current balance to prepare spending reports. The skill is read-only as written, but the output may contain confidential business financial details, so use it in trusted sessions and review reports before sharing them.
The skill explicitly retrieves transaction history and current company balance, which are sensitive financial data, but it provides no warning, consent check, or privacy framing before access and presentation. In a finance context this increases the chance of overexposing confidential business information to an unauthorized viewer or surfacing more data than the user expected.
The instructions specify amounts in EUR and the presentation section reinforces this requirement, which imposes a locale/currency format without any explicit user opt-in or documented regional justification. This can be a natural-language policy issue when the skill is not clearly limited to a EUR-specific audience.
The instruction to always keep amounts in EUR enforces a specific locale/currency convention. Because the skill description does not clearly limit usage to a EUR-specific region or offer a user choice, this may violate language/locale policy expectations.
No suspicious patterns detected.
