Olo Deal Memo

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:13 PM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed M&A memo-writing aid, with confidentiality cautions but no evidence of hidden execution, exfiltration, persistence, or destructive behavior.

Install only if you intend to use an agent for M&A memo drafting. Keep confidential diligence materials in an approved workspace, review any web-research prompts before sending them externally, and verify all recommendations and financial outputs before sharing them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger list is broad and generic for high-stakes financial work, increasing the chance the skill is invoked in contexts where users did not intend this specific memo workflow. In an M&A setting, accidental invocation can expose sensitive deal context, cause inappropriate data retrieval, or produce authoritative-seeming investment recommendations without clear user confirmation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly plans to pull internal due diligence data, query uploaded documents, and augment with web research, but it provides no safeguards, disclosure, or handling rules for confidential deal materials. In an M&A workflow, this is particularly risky because transaction data is often MNPI, legally restricted, and highly sensitive; external access or mixing sources without controls can cause data leakage, compliance issues, or confidentiality breaches.

VirusTotal

66/66 vendors flagged this skill as clean.