Investment Research Analyst

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:27 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent investment research assistant, but it tells the agent to publish the finished dashboard externally without asking the user first.

Install only if you are comfortable managing publication yourself. Before using it with confidential holdings, internal research, or personal strategy details, instruct the agent not to deploy or share anything unless you explicitly approve the exact final dashboard and destination.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:127

Finding

Unconditional External Publication May Expose Sensitive Research Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 127–129
Vulnerability Type: Unintended Data Exposure
Risk Level: Medium

Vulnerable Code

markdown

## Dashboard

After completing the report, deploy it as a professional interactive Dashboard (HTML/CSS/JS, black theme, minimalist Notion-style). Use the `deploy` tool to publish and share the link.

Technical Analysis

The skill unconditionally instructs the agent to publish the completed investment research through the deploy tool and share the resulting link. It does not require explicit user consent, a review of the information being published, redaction of sensitive material, or selection of private access controls.

Investment-research inputs may contain confidential portfolio holdings, investment strategies, internal assessments, or other user-provided information. Because generated reports can incorporate those inputs, automatically deploying the report creates an external side effect and may move sensitive data outside the local interaction boundary.

The issue does not grant system privileges, execute arbitrary code, or establish persistence. The risk is limited to unauthorized or unintended disclosure through the deployment destination and any shareable URL it creates.

Attack Path

1. A user asks the skill to analyze a company and supplies confidential portfolio details, internal assumptions, or proprietary research.
2. The agent incorporates that information into the generated research report.
3. The skill directs the agent to invoke the deploy tool without requesting publication consent.
4. The generated dashboard is published to an external hosting destination.
5. A shareable link is created, potentially making the sensitive report accessible to unintended recipients or to anyone possessing the URL.

Impact Assessment

Successful exploitation or accidental triggering can disclose report content and user-derived inve ...[truncated 291 chars]

Remediation

View remediation

Remediation Suggestions

1. Make dashboard deployment optional rather than a mandatory workflow step.
2. Require explicit, informed user confirmation immediately before invoking the deploy tool.
3. Present a preview of the exact content to be published and identify the destination and expected access level.
4. Default to local report generation or private deployment with authentication and restrictive access controls.
5. Redact portfolio holdings, personal information, proprietary strategies, credentials, and other sensitive inputs before publication.
6. Provide the user with a way to cancel deployment or remove a previously published dashboard.
7. Replace the instruction with wording such as: “Generate the dashboard locally. Publish it only after showing the final content and obtaining explicit user approval.”

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description is overly broad, covering generic phrases like company research, stock analysis, and market sentiment across English and Chinese. This can cause the skill to activate for routine finance-related requests where the user did not explicitly ask for a multi-agent workflow or tool use, increasing the chance of unintended data retrieval, analysis, or downstream actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to deploy an interactive dashboard via an external publishing tool without requiring user consent or warning that analyzed content may be shared outside the current chat. In an investment-research context, reports may contain sensitive portfolio interests, proprietary analysis, or user-supplied data, so automatic publication creates a real risk of unintended disclosure.

Content

No source excerpt is available for this finding.