T09 · Insecure Skill Coding Practices
Warning
- Location
references/profile.md:4- Finding
Plaintext Personal Financial Profile Included in the Distributable Package
- Content
View full analysis
- Remediation
View remediation
Security audit
Investment Analyzer
Security checks for vulnerabilities and agentic risk
Overview
The skill performs the advertised investment analysis, but it packages real personal financial and property details in plaintext and declares an apparently unrelated API credential requirement.
Review this carefully before installing. The skill appears to be a personal investment assistant, not a generic template: it exposes real income, debt, property, mortgage, ownership, and cloud document metadata to anyone who can read the package. Remove or replace those files with placeholders, verify whether GEMINI_API_KEY is actually needed, and install Python dependencies only from a trusted pinned environment. Treat outputs as rough analysis, not financial, tax, or legal advice.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/portfolio.md:7- Finding
Exact Property, Ownership, Debt, and Cloud Resource Metadata Exposed in Plaintext
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
scripts/analyze_etf.py:7- Finding
Unpinned yfinance Installation Guidance Creates Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
scripts/scan_properties.py:8- Finding
Unpinned Beautiful Soup Installation Guidance Creates Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
This mismatch becomes security-relevant because the skill appears to rely on external market data access while not declaring corresponding permissions or resources. Hidden or undocumented external-data behavior reduces transparency and can cause the agent to make unexpected network calls outside the user's understanding or administrator review.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
This mismatch becomes security-relevant because the skill appears to rely on external market data access while not declaring corresponding permissions or resources. Hidden or undocumented external-data behavior reduces transparency and can cause the agent to make unexpected network calls outside the user's understanding or administrator review.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This mismatch becomes security-relevant because the skill appears to rely on external market data access while not declaring corresponding permissions or resources. Hidden or undocumented external-data behavior reduces transparency and can cause the agent to make unexpected network calls outside the user's understanding or administrator review.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This mismatch becomes security-relevant because the skill appears to rely on external market data access while not declaring corresponding permissions or resources. Hidden or undocumented external-data behavior reduces transparency and can cause the agent to make unexpected network calls outside the user's understanding or administrator review.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This mismatch becomes security-relevant because the skill appears to rely on external market data access while not declaring corresponding permissions or resources. Hidden or undocumented external-data behavior reduces transparency and can cause the agent to make unexpected network calls outside the user's understanding or administrator review.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This file contains highly sensitive financial and real-estate information, including full property addresses, ownership splits, mortgage balances and rates, portfolio concentration, and cloud storage identifiers. In the context of an investment-analysis skill, storing this data in a plain markdown reference file increases the risk of privacy leakage, targeted fraud, social engineering, and unauthorized access attempts against linked resources.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill advertises workflows that invoke external scripts and likely network-backed data retrieval, but the manifest does not declare an explicit tool scope such as allowed tools or permissions. This creates a trust and review gap: the skill may access network-capable functionality without clear least-privilege boundaries, increasing the chance of unintended external requests or data exposure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest uses broad trigger phrases such as general investment-analysis terms, which can cause the skill to activate in contexts broader than the user intended. Overbroad activation can expose personal financial reference files or trigger external analysis workflows on unrelated conversations, increasing privacy and unintended-action risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Ambiguous workflow triggers increase the chance that the agent invokes scripts or uses sensitive financial context without sufficiently clear user intent. In a finance-oriented skill that references profile, portfolio, and LOC data, mistaken activation is more dangerous because it may process sensitive personal information or produce consequential advice unexpectedly.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The document includes a dedicated 'Quebec-Specific Notes' section and later prioritizes Quebec markets, which constrains the analysis to a specific locale. The file does not explicitly offer a user choice of region or state that the criteria are only for a Quebec-specific use case, creating a natural-language locale policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script emits categorical investment verdicts such as BUY, INVESTIGATE, and PASS without any disclaimer that the model is simplified, uses hard-coded assumptions, and is not financial advice. In an investment-analysis skill, users may over-trust this output and make real financial decisions based on incomplete or inapplicable assumptions, creating meaningful risk of financial harm.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The Accept-Language header is hard-coded to "fr-CA,fr;q=0.9", which imposes a specific language/locale policy on all requests. The file does not offer a user opt-in, configuration option, or documentation explaining why this locale restriction is required.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The instruction to "Always end with ✅ BUY / ⚠️ INVESTIGATE / ❌ PASS" imposes a fixed response convention regardless of user preference or locale. While this is primarily a formatting rule, it functions as a forced output policy without any opt-in or flexibility.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code performs a live network call via yfinance to fetch historical market data when no ETF return is provided. Although it is part of the calculation flow, there is no print/log/comment/docstring informing the user that running the script may contact an external service with the requested ticker.
- Content