Back to skill

Security audit

Binomial

Security checks for vulnerabilities and agentic risk

Overview

This skill only provides a local text reference, but much of its finance content is generic or mismatched to binomial finance and should not be relied on as expert guidance.

Install only if you want a lightweight local reference command. Treat its finance content as generic and unverified, especially for binomial option pricing or regulatory decisions; use authoritative financial references before acting on the guidance.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The 'When to Use' section uses generic conditions like 'need quick reference,' 'troubleshooting ... issues,' and 'need a checklist or guide,' which are broad enough to overlap with many ordinary finance-assistance requests. The file does not provide explicit trigger phrases, scope constraints, or negative examples to clarify when this skill should be selected versus other finance skills.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script presents itself as a finance-specific binomial reference tool, but the content is largely generic placeholder material and includes operational/equipment/inspection guidance unrelated to binomial finance concepts. This mismatch can mislead users or downstream agents into relying on incorrect domain guidance, causing unsafe or noncompliant decisions in financial workflows.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The inline description claims the tool is for binomial use in finance contexts, but several commands output broad operational, compliance, inspection, and equipment guidance that does not align with that purpose. In an agent setting, this kind of semantic mismatch increases the risk of the tool being selected and trusted for finance tasks while returning irrelevant or misleading advice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.