Security audit

freelance-debt-collector

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local invoice-collection helper with no hidden access or persistence, but users should verify its legal and jurisdiction guidance before acting on it.

Install only if you want an offline helper for organizing overdue invoices and drafting collection language. Treat caps, deadlines, fees, demand letters, and filing choices as starting points to verify against current local law, your contract, and qualified local advice before sending anything or filing a claim.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill promises jurisdiction-specific small-claims guidance across all 50 US states plus UK/EU references, but the implementation appears incomplete and includes a broken fallback path for unknown jurisdictions. In a legal/collections workflow, inaccurate caps or runtime failures can mislead users into choosing the wrong forum, miscalculating recovery, or missing escalation deadlines, creating operational and legal risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The playbook recommends escalating to a formal demand letter, small claims, or collections at fixed time intervals, but the nearby guidance does not clearly require checking jurisdiction-specific legal limits, contract enforceability, licensing rules, debt-collection laws, or whether the user is collecting their own debt versus acting as a third-party collector. In a legal/collections workflow skill, that omission can cause users to take procedurally improper or unlawful steps based on generic advice, creating legal exposure and harmful real-world actions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file header describes the 'ladders' command as providing the payment-reminder ladder, including an email draft for each invoice. In practice, cmd_ladders outputs the current step, tone, fees, and next-step date, but does not generate any actual reminder message body or draft text.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module documentation says the skill supports small-claims readiness with local caps, and the manifest claims coverage for all 50 US states plus UK/EU reference. However, when a jurisdiction is not found, the code attempts to use SC_CAPS["default"], but no such key exists in the table, so the fallback path will raise an error instead of providing an open-question reference result.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The CLI exposes a --json flag, which reasonably signals that the tool can emit structured JSON output. The code ignores the flag and always emits human-readable text, with a placeholder comment stating structured output is only reserved for future use.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.