Security audit

Wealth

Security checks for vulnerabilities and agentic risk

Overview

This is a plain Markdown wealth-planning guidance skill with no executable code, tools, network access, persistence, or hidden behavior, but users should treat it as educational and avoid sharing unnecessary sensitive financial details.

Install only if you want broad educational wealth-planning help. Do not share account numbers, SSNs, exact addresses, login credentials, or uniquely identifying financial details; use approximate values where possible, and consult qualified financial, tax, legal, or insurance professionals before acting on major recommendations.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The examples explicitly prompt users to share sensitive financial details such as income, debt balances, savings, retirement account values, inheritance amounts, and business income without any privacy minimization or warning. In a wealth-management skill, this increases the chance that users will disclose more personally identifiable and financially sensitive information than necessary, which could create privacy, profiling, or downstream data-handling risks if the agent logs, stores, or transmits the conversation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly invites users to provide sensitive financial details such as income, spending, investments, and net worth, but provides no warning about privacy, data minimization, or safe handling of personal information. In a wealth-management context, this increases the chance that users disclose highly sensitive data unnecessarily, which can create privacy, profiling, or downstream exposure risks if the conversation is stored, logged, or shared.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger list includes broad, common financial terms such as 'wealth', 'investing', 'retirement', and 'financial advisor', which can cause the skill to activate in many ordinary conversations that are not intentional invocations. In a finance-focused skill, accidental activation is especially risky because users may receive or act on financial guidance in the wrong context, increasing the chance of inappropriate or misplaced advice.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill’s scope is extremely broad and can be triggered by many ordinary personal-finance questions, increasing the chance that users receive sweeping financial guidance in contexts where narrower, safer handling would be more appropriate. In a high-stakes domain like investing, taxes, insurance, and estate planning, ambiguous activation raises the risk of overreaching advice and misplaced user reliance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill provides guidance in regulated and high-consequence areas—investing, taxes, insurance, retirement, and estate planning—without warning users that responses are educational and not personalized professional advice. This can cause users to treat generalized output as individualized financial, tax, or legal guidance, potentially leading to harmful decisions with significant monetary or legal consequences.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.