Caveat verdict
travel-expense-reimbursement
Enumerates directory contents AND makes external network calls
Automates travel reimbursement by reading email invoices, downloading PDFs, and submitting to an internal FOL system; all network calls are to expected corporate services with no exfiltration pattern.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
What it does
These are capability combinations: each listed behavior occurs in the skill, but Caveat detects co-occurrence — it does not verify that one flows into another. Read the code to confirm a live chain.
Enumerates directory contents AND makes external network calls — filesystem reconnaissance
LLM02 · LLM06 · ASI03
Permission integrity
network_out
Findings (4)
subprocess execution — runs system commands from Python
references/url_downloader.py · prose · downgraded · subprocess.run(
HTTP request to bare IP address — common in malicious payloads
references/url_downloader.py · prose · downgraded · http://127.0.0.1
Long base64 string (100+ chars) — likely obfuscated payload
references/url_downloader.py · prose · downgraded · B1F11C8790E4D6933F04A28D76E3969FE2E156CA378337A2A7D2957ECDF2B2804638C3709E991D2E
Python shutil file operation — copies/moves/deletes files
references/url_downloader.py · prose · downgraded · shutil.move(
Why the tier is capped
Execution sink present in raw bytes (Hard Floor: class D). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.
Permissions & capabilities
No declared permissions — minimal attack surface.
network_outdir_traversal Thanks — recorded.