T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze_beancount.py:38- Finding
Untrusted Beancount Ledgers Are Loaded Without Isolation
- Content
View full analysis
- Remediation
View remediation
Security audit
Personal Finance Beancount
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly coherent for Beancount/Fava finance work, but it should be reviewed because it can run a ledger analysis script on uploaded files without guarding against Beancount plugin/include behavior.
Install only if you intend to use it with Beancount/Fava financial records. Treat ledger files as sensitive, avoid running the analysis script on ledgers from other people unless sandboxed, and review any finance, tax, or investment output as educational rather than professional advice.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
README.md:48- Finding
Third-Party Packages Are Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
\ --hash=sha256: ``` 5. Pin optional dependencies such as `fava-dashboards` and `fava[excel]` separately so users install only the features they require. 6. Document the approved Python package index and discourage installation from arbitrary mirrors or additional indexes. 7. Install dependencies in a dedicated virtual environment under a non-privileged account rather than using system-wide or administrative installation. 8. Add automated dependency vulnerability and provenance scanning to the release process. 9. Review and update pinned versions through a controlled process that tests the analysis script and verifies package artifacts before release. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Refer to `references/fava_dashboards.md` for creating custom visualizations
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Refer to `references/fava_dashboards.md` for creating custom visualizations
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill description is broad enough to trigger on generic personal-finance questions, including budgeting, investment advice, and wealth-building topics that do not require Beancount or Fava. This can cause inappropriate routing to a domain-specific skill, increasing the chance the agent gives overconfident financial guidance outside its intended scope and accesses user financial files unnecessarily.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file instructs users to link external files to accounts and later recommends attaching documents, including examples like tax documents and statements. Because these behaviors can expose sensitive financial and personal data in ledgers or UI integrations, the description should include a clear warning about handling private documents and file paths safely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The Event directive examples explicitly store address, employer, and location history, which are sensitive personal data elements. The file presents this as normal usage but does not warn users that ledgers may contain private information that should be protected or shared cautiously.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This document provides detailed budgeting, tax, debt, and investment guidance with normative benchmarks and recommended actions, but it does not clearly state that the content is general educational information rather than personalized financial, tax, or investment advice. Users may reasonably rely on the guidance as tailored professional advice, leading to unsuitable financial decisions, regulatory/compliance exposure, or harm when the advice does not fit their jurisdiction, tax situation, risk tolerance, or objectives.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file documents that users can edit Beancount source files directly in the browser, which can change user data. Under the missing-warning rule for markdown, actions affecting user data should include some warning or disclosure, but the document presents the capability as purely convenience-oriented with no cautionary note.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The feature list explicitly includes viewing and uploading documents, which may affect user privacy and data handling. The document does not provide any warning that uploaded files may contain sensitive financial information or that users should verify storage/access controls.
- Content
Static analysis
No suspicious patterns detected.