Security audit
Security checks for vulnerabilities and agentic risk
This finance skill is not malicious, but it asks for broad file and command authority while handling sensitive financial data and making unsupported security claims.
Review this skill carefully before installing. Use it only with data you are allowed to process, avoid real bank/tax/customer records unless the host environment already provides approved storage and access controls, and do not rely on the skill’s security or compliance claims without separate verification.
The invocation wording is broad and ambiguous, encouraging use for loosely defined finance and data-analysis scenarios without clear boundaries. In an agent context with exec/write capabilities, vague scope can cause users or downstream agents to apply the skill to sensitive or inappropriate tasks, raising the chance of unsafe data handling or unintended command execution.
The skill documents importing bank statements and generating financial reports, but it does not prominently warn that these inputs and outputs may contain highly sensitive financial or personal data. Because the skill also advertises read/exec/write tooling, users may process regulated data without guidance on minimization, redaction, output handling, retention, or destination safety.
The skill explicitly asserts security properties such as encrypted storage, access control, and audit logging, but the file is only documentation and examples with no implementation or enforceable mechanism behind those claims. In a finance-focused skill, these statements can mislead users into handling sensitive accounting or tax data under a false sense of protection, increasing the risk of data exposure or compliance failures.
No suspicious patterns detected.
