Portfolio Risk Analyzer

• Outcome: Pass
• Latest audit: May 28, 2026, 11:39 AM
• Version:
  1.0.0

Overview

This is an instruction-only portfolio risk analysis skill whose web lookups and financial calculations fit its stated purpose, but users should treat portfolio details as sensitive.

Install only if you are comfortable giving your agent portfolio holdings and allowing ticker-level web searches. Avoid sharing brokerage credentials, account numbers, tax IDs, or unnecessary personal details, and verify any rebalancing, tax-loss harvesting, or investment recommendation with authoritative sources or a qualified professional before acting.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README encourages users to provide detailed portfolio holdings and implies the agent will use web search and live price lookups, but it does not warn that sensitive financial data may be exposed to external services, logs, or model providers. Portfolio composition, cash balances, and tax-related data are highly sensitive, so omission of privacy guidance can lead users to disclose information they would not otherwise share.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill directs the agent to perform web searches for each portfolio holding and related metrics, which can expose a user's sensitive financial interests to third-party search providers without notice or consent. Portfolio composition is highly sensitive personal financial data, and repeated ticker-specific queries can leak holdings, strategy, or account characteristics through observable search traffic.

VirusTotal

64/64 vendors flagged this skill as clean.