record-ai-bookkeeping
Warn
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides templates for executing shell commands using user-supplied strings, such as
python3 "$AI_BOOKKEEPING_HOME/scripts/bookkeeping.py" ... record "用户原话". This implementation is vulnerable to command injection if the user input contains shell metacharacters (e.g., semicolons, backticks, or dollar-sign syntax) that are not properly escaped or sanitized by the agent platform before execution. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from the user to drive transaction logging and script execution.
- Ingestion points: Natural language input describing transaction details (amount, account, category, etc.) provided by the user in the prompt.
- Boundary markers: The instructions use double quotes to wrap the user input variable in shell command examples, which does not provide security against nested quotes or shell escapes within the user's string.
- Capability inventory: The skill possesses the capability to execute a Python script (
bookkeeping.py) which can read/write configuration files, modify databases (record/update/undo transactions), and handle environment variables. - Sanitization: The instructions lack specific guidance or requirements for sanitizing, validating, or escaping the user's raw input before it is passed to the shell environment.
Audit Metadata