actual-budget-api-expert
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [PROMPT_INJECTION] (HIGH): This skill is vulnerable to Indirect Prompt Injection (Category 8).
- Ingestion points: Untrusted data enters via
api.getTransactions(),api.getPayees(), andapi.getAccounts()(SKILL.md). - Boundary markers: None identified; the documentation does not advise on delimiting transaction data from instructions.
- Capability inventory: The skill provides extensive write capabilities, including
api.deleteAccount(),api.closeAccount(),api.deleteTransaction(), andapi.setBudgetAmount()(SKILL.md). - Sanitization: None identified. An attacker could embed instructions in a transaction memo that, when read by the agent, trigger unauthorized financial operations.
- [EXTERNAL_DOWNLOADS] (MEDIUM): The skill requires the installation of
@actual-app/apivia npm. This is an external dependency from a repository/organization not included in the trusted sources list. - [COMMAND_EXECUTION] (MEDIUM): The API facilitates programmatic modification of local filesystem data (
dataDir) and remote server synchronization, which could be abused if the agent is manipulated. - [CREDENTIALS_UNSAFE] (LOW): The
api.initdocumentation includes apasswordparameter, which may lead to the exposure or hardcoding of sensitive sync server credentials.
Recommendations
- AI detected serious security threats
Audit Metadata