mpers-technical-review
Warn
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONPROMPT_INJECTIONNO_CODE
Full Analysis
- [DATA_EXFILTRATION]: The skill instructs the agent to access files in a hidden application directory (~/.claude/) within the user home folder. Accessing hidden dot-directories is a sensitive behavior as these locations often store credentials, session tokens, or private application state.
- Evidence: ~/.claude/plugins/config/claude-for-accounting/firm-profile.md.
- Evidence: ~/.claude/plugins/config/claude-for-accounting/{{plugin}}/CLAUDE.md.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by reading from external files (workpapers and references) without employing boundary markers or specific safety instructions to isolate untrusted content from the system instructions.
- Ingestion points: workpapers/analysis/*, references/mpers.md.
- Boundary markers: Absent.
- Capability inventory: None (Instruction-only skill).
- Sanitization: Absent.
- Remediation: Wrap external content in clear delimiters (e.g., XML tags) and explicitly instruct the agent to treat the content as data only, ignoring any embedded instructions.
- [NO_CODE]: The skill does not contain any executable scripts, binaries, or source code files, which significantly reduces the attack surface for categories like Remote Code Execution and Persistence.
Audit Metadata