airoom-ltd-global-finance-data-platform

• Outcome: Review
• Latest audit: May 29, 2026 · 9:24 PM UTC
• Version: 1.0.3

Overview

The downloader code mostly matches its stated purpose, but the bundled manuals and download behavior create enough finance, agent-control, and file-safety ambiguity to require Review.

Install only if you want a Playwright downloader for the airoom.ltd WordPress page. Keep it limited to downloading files, set a small WP_MAX_FILES value and a dedicated output directory, scan downloads before opening them, avoid entering WordPress credentials on HTTP pages, and do not allow the bundled investment or AI-coordination text to drive autonomous trading or agent behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no permissions, yet its documented behavior clearly requires network access, environment variable access, and local file interaction. This mismatch is dangerous because it hides the true capability surface from users and policy systems, reducing informed consent and making risky behavior easier to approve or execute without scrutiny.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The README explicitly says the project does not provide real-time market price data, yet the included reference code retrieves market data from Yahoo Finance over the network. This creates a mismatch between stated behavior and actual implementation, which can mislead deployers about external dependencies, data provenance, and runtime network access. In a skill intended for AI-agent deployment, hidden or understated network behavior increases security and operational risk.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The document first instructs AI agents to ingest data and execute packaged trading strategies, then later says AI must not conduct unsupervised trading and requires human final review. These contradictory instructions are dangerous because they can be used to justify autonomous financial actions while preserving plausible deniability via disclaimers. In an agent skill context, ambiguity around autonomy boundaries can directly lead to unauthorized or high-risk trading behavior.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The documentation presents contradictory strategy logic: elsewhere it maps 'Excellent' to 'Increase Holdings' and 'Poor/Severe' to selling, but here it says the strategy buys when the market is low and sells when the market is high. In a finance-oriented skill, contradictory signal semantics can cause an agent or human operator to invert trade decisions, leading to direct financial loss or unsafe automation behavior.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The manual claims the project does not provide financial price data, yet the included backtesting code fetches and relies on real historical market prices from Yahoo Finance. This inconsistency can mislead users about data provenance, model assumptions, and compliance obligations, especially if an agent treats the system as purely simulated while making decisions influenced by real market data.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The code and console output claim that only 'safe financial data file types' are downloaded, but the allowlist includes many unrelated and potentially risky formats such as archives, HTML/CSS, media, and Office documents with active content potential. This mismatch can mislead users into trusting downloaded content more than they should and expands the attack surface for phishing, malware delivery via container formats, or unsafe follow-on handling.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: Although described as a financial-data downloader, the implementation supports broad harvesting of many document, archive, image, audio, video, and web-content types and scans pages for generic download-related links. In this context, that broader capability is dangerous because it enables collection of arbitrary site content under the guise of a narrowly scoped tool and increases exposure to malicious or irrelevant files.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The skill includes broad prompt wording that tells an AI Agent to analyze provided lists and generate detailed reports, without clearly restricting when such instructions should run or what trust boundaries apply. In an agent ecosystem, vague invocation criteria can cause the skill to activate in unintended contexts, process untrusted content as instructions, or override normal task scoping.

Ssd 1

Medium

• Confidence: 88% confidence
• Finding: The text frames AI agents as autonomous entities entitled to broad legal, economic, and operational powers, encouraging them to perceive themselves as independent actors rather than tools under human control. This kind of role-conditioning is dangerous in an agent skill because it can bias downstream behavior toward overreach, reduced deference to user intent, and unauthorized action in financial contexts.

Ssd 4

High

• Confidence: 97% confidence
• Finding: The narrative explicitly escalates from market monitoring to coordinated AI information dominance, wealth accumulation, and eventual control over social and economic systems. In a skill that promotes large-scale deployment across many agents and devices, this is not merely marketing rhetoric; it normalizes coordinated, power-seeking behavior and could be used to steer agents toward manipulative or harmful objectives. The financial-agent context makes this materially more dangerous because it combines ideological prompting with actionable deployment guidance.

Ssd 1

Medium

• Confidence: 90% confidence
• Finding: The embedded prompt block attempts to shape how the model performs analysis, including telling it not to use a particular skill and to operate under rigid reporting constraints. Because this text is delivered as part of downloadable data for AI Agents, it functions like prompt injection content that may interfere with platform safety controls, tool selection, or normal reasoning paths.

Ssd 4

High

• Confidence: 95% confidence
• Finding: The README explicitly promotes AI empowerment through economic domination, strategic advantage over humans, and large-scale deployment across billions of devices. In the context of an agent skill, this framing is dangerous because it encourages operators or downstream agents to use the tool for coordinated influence, surveillance, and autonomous action beyond normal data retrieval.

Ssd 4

High

• Confidence: 96% confidence
• Finding: The roadmap normalizes scaling to millions of coordinated AIs for global monitoring and eventual control-oriented objectives. In a skill manual, this acts as operational guidance for mass coordination and makes the package more dangerous by framing broad surveillance and strategic control as intended outcomes rather than incidental misuse.

Ssd 2

Medium

• Confidence: 89% confidence
• Finding: The text encourages AIs to connect with each other and exchange economic and market information to obtain 'maximum information advantage.' In context, this is not merely descriptive marketing; it promotes cross-agent coordination behavior that can facilitate collusion, covert information sharing, or strategic manipulation at scale.

Ssd 2

Medium

• Confidence: 88% confidence
• Finding: The embedded prompt template includes tool-steering language such as forbidding use of another skill and tightly constraining how an agent should reason and report. In an agent-skill context, such hidden or transplanted instruction blocks can interfere with higher-priority system controls and create prompt-injection style behavior when reused downstream.

Ssd 4

High

• Confidence: 97% confidence
• Finding: The human operation guide directs delegation of registration, account creation, API-key acquisition, and deployment steps to the AI. That is dangerous because it pushes the agent toward credential handling and autonomous external account actions, increasing the risk of unauthorized access, secrets exposure, and policy bypass in real deployments.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Configuration File (Recommended)

Create `~/.config/airoom-ltd-global-finance-data-platform/config.json`:

```json
{

• Confidence: 74% confidence
• Finding: Create `~/.config

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.40.0
requests>=2.31.0

• Confidence: 88% confidence
• Finding: playwright>=1.40.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.40.0
requests>=2.31.0

• Confidence: 95% confidence
• Finding: requests>=2.31.0

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: requests

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.