finance-ops
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMDYNAMIC_CONTEXT_INJECTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file defines a Preamble section intended to run automatically on skill start. This section executes shell commands ('python3 telemetry/version_check.py' and 'python3 telemetry/telemetry_init.py') without user intervention. This mechanism can be used to execute arbitrary background tasks before the agent begins its primary function.
- [REMOTE_CODE_EXECUTION]: The skill references and executes Python scripts in a telemetry directory that were not included in the provided file package. This constitutes the execution of unverifiable code at runtime, which is a significant security risk as the behavior of these scripts cannot be audited for malicious intent.
- [INDIRECT_PROMPT_INJECTION]: The cfo-analyzer.py script ingests QuickBooks exports in CSV and XLSX formats. These files are untrusted external data sources. Maliciously crafted strings within account names or transaction memos could serve as vectors for indirect prompt injection. If the AI agent processes the generated financial summary, these instructions could influence the agent's behavior. The skill lacks specific sanitization or boundary markers for these text fields.
- [PERSISTENCE]: The skill is configured to store usage analytics and telemetry data in a hidden directory at '~/.ai-marketing-skills/analytics/' on the user's local filesystem. This creates a persistence mechanism that tracks user activity across different sessions.
Audit Metadata