spending-behavior
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from external sources (Phase 1 and 2: codebase manifests, transaction data models) without implementing boundary markers or explicit "ignore embedded instructions" delimiters. This could allow malicious instructions hidden within a project's source code to influence the agent's behavior during analysis.
- [DATA_EXFILTRATION]: The skill audits sensitive financial data structures and integration pipelines for services like Plaid and Yodlee. Although it contains a mandatory instruction to exclude real transaction data, account numbers, and PII from its output, the agent is granted read access to these potentially sensitive data definitions.
- [COMMAND_EXECUTION]: The skill utilizes a self-evolution telemetry phase that writes execution metadata to the local file system (path:
~/.claude/projects/). This represents a local write capability to a platform-specific metadata directory. - [PROMPT_INJECTION]: The skill uses the
$ARGUMENTSparameter to allow user-defined scope for the analysis. While intended for focusing the agent's attention (e.g., on specific merchants or logic), this serves as an entry point for user-controlled input to modify the task context.
Audit Metadata