Bank Reconciler Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:53 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent bank-reconciliation purpose, but it handles sensitive financial files with under-disclosed sharing/export behavior and invokes an external PDF parser without clear containment.

Review this skill before installing in any real finance workflow. Use it only with data you are allowed to process, avoid sending reports to Feishu unless that sharing is approved, treat generated spreadsheets as untrusted, and run PDF parsing in a constrained environment because it calls an external command-line parser.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/exporter.py:113

Finding

Spreadsheet Formula Injection Through Untrusted Reconciliation Data

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/tier_config.py:31

Finding

Paid-Tier Authorization Can Be Forged and Usage Restrictions Are Not Enforced

Content

View full analysis

str: """Detect tier from token prefix or plan_id.""" if not self.token: return "FREE" token_upper = self.token.upper() for tier_name, prefix in TOKEN_PREFIXES.items(): if token_upper.startswith(prefix): return tier_name return "FREE" ``` Token validation repeats the same prefix-only decision: ```python def validate_token_for_tier(token: str, required_tier: str) -> bool: if not token: return required_tier == "FREE" token_upper = token.upper() required_prefix = TOKEN_PREFIXES.get(required_tier, "") if not required_prefix: return True return token_upper.startswith(required_prefix) ``` The main entry point trusts the resulting object and only checks one capability: ```python if tier is None: tier = TierConfig() # ... if tier.can_export_excel() and ( result["matched"] or result["differences"] or result["unclaimed"] or result["unmatched_orders"] ): exporter = ReconciliationExporter() excel_path = exporter.export(result) result["excel_path"] = excel_path ``` ## ...[truncated 2517 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README presents an AI-powered bank reconciliation workflow handling bank statements, orders, invoices, and third-party platform data, but it provides no warning about sensitive financial/PII handling, retention, redaction, or risks of sending data to external integrations such as Feishu and payment platforms. In this context, users may upload highly sensitive account and transaction data without understanding exposure, creating a realistic risk of privacy breaches, regulatory noncompliance, or accidental disclosure through connected services.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documents capabilities that imply reading uploaded files, exporting Excel outputs, and potentially invoking shell-like processing, but it declares no explicit tool scope or permissions boundaries. In a financial-reconciliation context, this is dangerous because highly sensitive banking and order data may be processed with broader-than-necessary access, increasing the risk of unauthorized file access, unsafe execution paths, or data exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill supports exporting reconciliation results to Excel and pushing summaries to Feishu, but it does not clearly warn users that sensitive financial and transaction data may be written to files or sent to a third-party messaging platform. In this context, the data includes bank statements, counterparties, balances, and order/payment details, so silent export or sharing can cause confidentiality breaches and compliance issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code hard-codes Chinese sheet names, headers, status values, and summary labels throughout the exported workbook and CSV output. Because there is no user opt-in, locale selection, or documented region-specific justification in the file, it creates a language/locale policy violation under the natural-language policy rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code emits Feishu card content in Chinese, beginning with the title at L038 and continuing throughout the generated messages and button labels. The file provides no user opt-in, fallback language, or justification that the skill is intentionally limited to a Chinese-language context, which violates the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file returns the natural-language status value "待处理" in output records, which forces a specific language in user-visible data. There is no opt-in, localization mechanism, or documentation indicating this skill is intentionally restricted to a Chinese-language environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes uploading statements/orders and performing AI-based matching, while this parser file implements PDF extraction by launching an external command-line tool via subprocess. Spawning a host executable is a materially broader capability than ordinary file parsing and is not clearly justified or declared by the stated skill purpose in this code context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code processes sensitive bank statements by passing them to an external CLI without any visible disclosure, consent, or audit controls in this file. In a financial reconciliation skill, this raises privacy and compliance concerns because users may not expect uploaded documents to be handled by a separate executable with its own logging, storage, or network behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 82% confidence

Finding

The code invokes an external CLI on a user-supplied PDF path, which expands the trust boundary from in-process parsing to execution of another binary. Although shell injection is mitigated by passing an argument list to subprocess.run, this still creates risk from unsafe handling of attacker-controlled PDFs by the external parser, PATH/binary hijacking, and unintended access to sensitive local files if filepath is not constrained.

Content

Scanner excerpt · scripts/parser.py (reported line 249)May include surrounding context.

python

"""Parse PDF file using doc_parse."""
        import subprocess
        
        result = subprocess.run(
            ["miaoda-studio-cli", "doc-parse", "--file", filepath, "--output", "text"],
            capture_output=True, text=True, timeout=60
        )

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The order parser repeats the same pattern of invoking an external executable to process PDFs. For a skill presented as a bank statement reconciler/parser, executing external programs is a broader operational capability than the manifest and docstrings suggest, even if used for document conversion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The same undisclosed external processing occurs for order and invoice PDFs, which may contain customer identities, payment details, and invoice data. Given the skill's finance/accounting context, silent handoff of sensitive files to another executable increases data-handling risk and weakens informed consent and transparency.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 82% confidence

Finding

This order/invoice PDF parser also launches an external command on a user-controlled file path, inheriting the same risk profile as the statement parser. The danger is not classic command injection here, but exposure to vulnerabilities in the external parser, execution of an unexpected binary from PATH, and processing of highly sensitive financial documents outside the Python process.

Content

Scanner excerpt · scripts/parser.py (reported line 532)May include surrounding context.

python

"""Parse PDF file."""
        import subprocess
        
        result = subprocess.run(
            ["miaoda-studio-cli", "doc-parse", "--file", filepath, "--output", "text"],
            capture_output=True, text=True, timeout=60
        )

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file documents bank statements, payment exports, and e-commerce records containing account numbers, names, balances, and transaction details. The description provides no warning that these formats may include sensitive personal or financial data, which is a missing user-facing disclosure for markdown content that could affect privacy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.