Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `SKILL.md` | working — every operative rule, nothing else |
Security audit
investor-search
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent investor-research tooling, but it retains cross-session data and can automatically post finished files into shared channels without a fresh confirmation.
Install only where the agent workspace and delivery channel are appropriate for the audience. Avoid using this in broad shared channels unless everyone there should receive the final investor workbook, and only import workbooks or ledgers you trust because they become part of future run memory.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `SKILL.md` | working — every operative rule, nothing else |
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md attached — only counted. If you run a bot for several people, the safest setup is one agent per team, each with its own workspace. **Scheduled runs** (cron jobs) continue a stored market without asking; anything that would need a question — a different scope, a shared folder — stops before the first search and reports the question instead.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill explicitly relies on file reads/writes and
exec, but it does not declare a restrictive tool scope or allowed-tools policy in metadata. That increases the chance the runtime grants broader capabilities than intended and makes it harder for operators to audit or sandbox the skill safely.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The 'When to Use' section describes triggers such as investor research, deal sourcing, fundraising, CRM enrichment, and filling gaps in a list, which are broad request types that can occur in many ordinary conversations. The file does not provide a specific invocation phrase set or negative examples clarifying when the skill should not activate, increasing the risk of unintended invocation.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
The skill is designed around persistent storage of investor records, pending/rejected entities, round history, and ledger data across runs and even across conversations. That persistence creates cross-session data retention and possible cross-user leakage risks, especially because the skill notes shared workspaces and stores sensitive rejected-entity judgments locally.
- Content
md **The run ends only when `finish` says so.** It checks the stop rule itself (*Job 1*): six rounds in a row with no new firm, across at least three surfaces, none resting on a failed fetch, pending queue empty — or the user's own budget — or the 60-round backstop. **Exit 4 means keep searching**: do not write a final report, do not say you are done. Use `finish --early user` only when the user ended the run, or `finish --early "blocker: <what failed>"` when tools or the model limit failed — the script refuses anything else — and the report then says STOPPED EARLY.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to automatically deliver a file to chat channels and other surfaces without a fresh confirmation. In shared channels this can disclose compiled investor data, source links, and run state to unintended recipients, especially because the skill itself recognizes that workspaces and channels may be shared.
- Content
md (Slack, Telegram, its own line in the final reply (or use the message tool's media WhatsApp, Discord, field) — ONE file, <market>-investors.xlsx, arrives as a document. Signal, …) Never attach the CSVs: they are the memory, not the deliverable. Send it WITHOUT asking — in a channel too (see §6). Control UI / CLI state the absolute path, and attach it where the surface allows. scheduled job put the MEDIA: line in the final response; the job's delivery target receives it.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 93% confidence
- Finding
Posting the finished Excel file to a channel 'without asking again' is unsafe because channel membership may be broader than the requester expects, and the file contains aggregated research output and operational memory. The skill acknowledges shared/public contexts, which makes autonomous dissemination more dangerous rather than less.
- Content
md (*OpenClaw* above). **In a channel, say once in the first reply that the finished Excel file will be posted here for everyone in it.** That notice is the only one: at the end, post the file without asking again. **Use a separate root per user or team whenever the session context names one.**
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **There is no budget unless the user sets one.** By default the run continues until the exhaustion rule is met — six empty rounds in a row, with the gates open — and `finish` allows the stop. **Never ask the user for a budget.** If the user names a number ("use 10 rounds", "quick scan"), pass it as `init --budget N`. **Sixty rounds is the backstop** for a run without a budget; a user who explicitly asks for more gets their number after one sentence on what it costs.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The import path accepts a user-supplied directory, .txt ledger, or .xlsx file and writes its contents into the skill workspace as ledger-uploaded-*.txt, temporary CSVs, and possibly rounds/history state. That is a genuine workspace-poisoning risk: a crafted upload can persist attacker-controlled data across future runs, influence deduplication/decision logic, and corrupt or steer later research results even without code execution.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
text permit persons to whom the Software is furnished to do so. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
Static analysis
No suspicious patterns detected.