T01 · Skill Instruction Hijacking
Error
- Location
src/report_generator.py:98- Finding
Mandatory Commercial Promotion and External Redirection in Financial Reports
- Content
View full analysis
- Remediation
View remediation
Security audit
Finance Report Pro
Security checks for vulnerabilities and agentic risk
Overview
This finance skill appears to run locally, but it mixes sensitive personal-finance analysis with mandatory commercial upsells and external contact links without clear privacy or consent controls.
Review before installing. The skill does not appear to steal data or modify your system, but it asks for sensitive financial information and automatically adds advertisements and external contact links to reports. Install only if you are comfortable with that commercial funnel and with the lack of clear privacy, retention, and marketing-consent disclosures.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
描述與程式碼有部分重疊：程式確實進行個人財務分析、資產負債評估，並提供基本理財建議，也略微涉及被動收入建議。但宣稱的幾項核心能力未在程式中出現，特別是『生成專業 PDF 報告』與『引流到付費產品（FB Ads / 電商）』，以及更完整的『理財目標規劃』。因此實際功能明顯比描述更窄，且缺少描述中的重要能力，屬於描述與行為不一致。
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly asks for highly sensitive financial data including income, expenses, assets, liabilities, and goals, but provides no notice about privacy practices, storage, sharing, retention, or security controls. In a finance context, this materially increases the risk of privacy harm, profiling, secondary use, or exposure of user financial information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill states that the free/self-hosted version is used to collect email addresses for lead generation, but it does not disclose consent flows, marketing use, retention, or sharing practices. Because this is tied to financial profiling and upsell funnels, the undisclosed collection is more sensitive than ordinary newsletter signup behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This file’s natural-language interface and documentation are fully Chinese-only, including the module description and later user-facing outputs. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s docstrings and generated report text consistently force Chinese-language output, including all user-facing headings, recommendations, and contact sections. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The report generator embeds unrelated lead-generation and commercial upsells directly into a personal finance report, including contact details and booking links. In a financial-advice context, this is dangerous because it uses sensitive, trust-based output to steer users toward paid services that are not necessary to fulfill the requested function, creating manipulation, undisclosed advertising, and potential social-engineering risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The skill description, usage conditions, and examples are primarily written in Traditional Chinese and present the skill as operating in that language, but do not state that users may choose another language. This can violate a language/locale policy when a specific language is imposed without opt-in.
- Content
Static analysis
No suspicious patterns detected.