Security audit

财务会计入门工具

Security checks for vulnerabilities and agentic risk

Overview

This finance skill is mostly a local accounting guide, but it asks for read/exec authority while its routing, install/runtime setup, and network-related documentation are under-scoped for sensitive financial data.

Install only if you are comfortable with a finance skill that can read files and run local commands. Before using it with real bank statements or accounting data, confirm what `finance.py` is, where it comes from, and that each command will act only on the intended local files. Treat the local-only privacy claim cautiously until the network/API documentation is clarified.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The documentation makes a strong privacy claim that all financial data remains local and is never uploaded, but nearby sections also mention network/API behavior and troubleshooting with network connectivity. In a finance tool, contradictory statements about data flow can mislead users into exposing sensitive accounting data under a false expectation of strictly local processing.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: This skill is presented as a local accounting utility, yet it includes network-oriented guidance and security notes unrelated to its stated purpose. Unjustified network capability in a financial context expands the attack surface and creates ambiguity about whether sensitive bookkeeping data could be transmitted or whether operators may be induced to perform unsafe connectivity actions.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The invocation description is overly broad, covering generic analytics, reporting, statistics, and visualization requests beyond narrow accounting tasks. This increases the chance the skill is auto-selected in contexts it was not designed for, causing unnecessary execution permissions to be granted to a finance-focused skill with exec capability.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The capability coverage section enumerates broad keywords and vague scenarios without clear trigger boundaries, effectively widening when the skill may be invoked. In an agent environment, ambiguous routing can lead to this skill handling unrelated requests and invoking local execution unnecessarily, increasing misuse risk.

Static analysis

No suspicious patterns detected.