copilot-money
Warn
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the
copilot-money-clipackage via pip. This is a third-party dependency that is not from a verified or well-known organization. - [COMMAND_EXECUTION]: The skill provides instructions to execute multiple CLI commands that interact with the local file system and network. This includes the
config initcommand which performs automated data collection from local application databases. - [CREDENTIALS_UNSAFE]: The skill automates the extraction of authentication tokens from browser local storage (IndexedDB) for browsers including Chrome, Safari, Firefox, and Arc. It stores these sensitive session tokens in a local configuration file at
~/.config/copilot-money/config.json. - [DATA_EXFILTRATION]: The tool is designed to query and process sensitive personal financial information, including bank account balances, full transaction histories, investment holdings, and net worth data.
Audit Metadata