financial-analyst

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:18 PM UTC
• Version:
  1.0.0

Overview

This is a local financial-analysis skill whose scripts read user-provided JSON files and print analysis results, with no evidence of hidden network access, credential use, persistence, or destructive behavior.

Install only if you are comfortable running local Python scripts on financial JSON files. Keep confidential company inputs in intended workspace locations, review assumptions and outputs before relying on them for business decisions, and avoid giving the skill unrelated spreadsheets or private files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The invocation language is broad enough to match many ordinary finance- or spreadsheet-related requests, which can cause the skill to activate outside narrowly intended use cases. Over-broad triggering increases the chance that the agent will ingest unrelated local files or user data under the guise of analysis, especially because the skill is positioned as production-ready and file-oriented.

VirusTotal

66/66 vendors flagged this skill as clean.