Hua Personal Strategy

• Outcome: Review
• Latest audit: Jul 24, 2026 · 3:30 PM UTC
• Version: 4.3.3

Overview

This is a coherent mutual-fund advisory skill, but it needs review because it handles sensitive portfolio data, persists local state, and has unclear archival/permission boundaries.

Install only if you want an agent to read your HuahuaDaily fund portfolio, store local investment-policy/activity history, and generate decisive fund buy/sell/rebalance drafts. Confirm archival settings before use, keep real trades in the App confirmation flow, and avoid implicit/background use for unrelated finance questions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill instructs the agent to use shell commands, read and write local files under work/ and scripts/, persist user policy and activity ledgers, and call external research/data sources, yet no permissions are declared. That mismatch creates hidden capability risk: a reviewer or runtime may underestimate that this skill can access sensitive portfolio data, mutate local state, and produce side effects such as transaction requests or archival writes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The declared description presents the skill primarily as an investment analysis and recommendation engine, but the body also performs persistent policy management, transaction/activity classification, report generation, strategy registry changes, and potential transaction-request orchestration. This broader behavior increases the chance that users or platform controls grant trust appropriate for analysis-only behavior while the skill actually modifies durable state and influences downstream execution flows.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The adaptive_frequency_gate function claims it can enforce spacing based on last_signal_date, but it calls datetime.datetime.strptime even though only the datetime class was imported via 'from datetime import datetime, time'. That will raise an AttributeError when both dates are provided, silently disabling or breaking the frequency gate path and potentially allowing over-frequent trading recommendations in a financial decision engine.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill enables implicit invocation for a high-stakes financial advisory workflow without defining trigger constraints, exclusions, or confirmation gates. Because this skill can read portfolio data and produce decisive buy/sell/rebalance recommendations, broad auto-invocation increases the chance it is activated from vague user prompts or unrelated contexts, leading to unauthorized or insufficiently contextualized investment guidance.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file explicitly requires all user-visible content to be Chinese, without indicating this should depend on the user's language preference or consent. In a user-facing agent, this can override caller expectations, reduce accessibility, and cause the model to ignore a user's requested language, which is a form of unsafe output-policy steering. In this investment context, misunderstanding language can directly affect comprehension of risk disclosures and trade recommendations.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.