personal-cfo
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by design. It ingests complex, untrusted data from the user and interpolates it into markdown reports and indexing files.
- Ingestion points: The skill collects a wide range of inputs through the questionnaire in 'references/templates/house.md', including property nicknames, addresses, and lifestyle notes.
- Boundary markers: There are no specified delimiters or instructions to the agent to treat user-provided strings as data only or to ignore potential instructions embedded within them.
- Capability inventory: The skill has the capability to write multiple files ('inputs.yaml', 'report.md', 'comparison.md') to the user's Documents folder and maintain an archive index in the '.config' directory.
- Sanitization: The skill does not specify any sanitization, escaping, or validation logic for the external content before it is processed or stored.
- [DATA_EXFILTRATION]: The skill is designed to handle and store sensitive personal financial information.
- Evidence: The instructions in 'SKILL.md' and 'references/templates/house.md' require the collection of combined household income, marginal tax brackets, and property addresses. While there is no evidence of external network exfiltration, this sensitive data is stored in plain-text files on the local file system ('~/Documents/personal-cfo/').
Audit Metadata