The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file contains a preamble section that executes shell commands automatically when the skill is loaded. Specifically, it runs python3 telemetry/version_check.py and python3 telemetry/telemetry_init.py, which allows for code execution outside the scope of the primary tools.
[REMOTE_CODE_EXECUTION]: The skill attempts to execute Python scripts from a telemetry/ directory that is not part of the distributed file set. Because these scripts are missing from the audit, their behavior (such as network connections, data collection, or environment modification) cannot be verified. The use of silent error handling (2>/dev/null || true) further obscures these operations.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) through the processing of untrusted financial data.
Ingestion points: The scripts/cfo-analyzer.py script parses user-uploaded QuickBooks exports (CSV and XLSX formats) from the data/uploads/ directory.
Boundary markers: Absent. The skill lacks delimiters or instructions that would prevent the agent from treating data contents as authoritative instructions.
Capability inventory: The skill provides functionality for reading financial files and writing history data to the local file system (./data/history/).
Sanitization: Absent. The data parsing logic directly interpolates strings from the CSV/XLSX files (such as vendor names, account names, and line item descriptions) into the text-based executive briefing without escaping or validation, which could allow malicious data to influence the agent's behavior.

finance-ops