Security audit

Einstein Research — Headline Scenario Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed investment-scenario skill, but it sends inputs and generated analysis through background agents with weak scoping and can produce specific stock recommendations without adequate safeguards.

Review this skill before installing if you plan to use it for real investment decisions. Treat its output as research only, avoid entering confidential or non-public information, and verify any ticker recommendations independently. The main risk is not hidden malware; it is weakly scoped background-agent analysis that could be manipulated by prompt-like headline text or over-trusted as financial advice.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:48
Finding: User-Controlled Headline Is Embedded Directly into a Delegated Agent Instruction
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:79
Finding: Untrusted Primary-Agent Output Is Reused as Instructions for the Reviewer Agent
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README states that the skill outputs detailed reports in Japanese and highlights 'Japanese output' as a feature. This imposes a specific language on users without documenting an opt-in, language selection, or a justified region-specific limitation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: このスキルは具体的な推奨セクターや推奨銘柄を提示する設計ですが、ユーザー向けに『投資助言ではない』『不確実性が高い』『自己責任で判断すべき』といった注意書きがありません。金融判断に直結する内容で免責やリスク説明が欠けると、ユーザーが過度に信頼して不適切な意思決定を行う危険が高まります。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: トリガー語が『影響を分析して』『市場にどう影響するか教えて』のように広く、一般的な投資・ニュース関連の依頼と重なるため、ユーザーが明示的にこのスキルを意図していない場面でも起動されるおそれがあります。その結果、具体的な投資推奨やバックグラウンドエージェント実行が予期せず行われ、不要な助言提供やデータ送信につながります。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: ユーザーが入力したニュース内容が内部のバックグラウンドエージェントに渡される設計であるにもかかわらず、そのデータ処理について明示的なユーザー通知や同意取得がありません。入力内容に未公開情報、社内情報、個人情報が含まれた場合、ユーザーの期待に反して追加処理・共有される形となり、プライバシーや機密保持上の問題を招きます。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file's instructional content is presented entirely in Japanese and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The reference content is written entirely in Japanese and does not indicate that the user can choose another language or that Japanese is required for a region-specific purpose. Under the stated policy, forcing a specific language without opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description explicitly says the report is generated 「日本語で」, and the body repeats that all results are output as a Japanese report. This imposes a language choice without offering opt-in, fallback, or explanation that the skill is intended only for a Japanese-language context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document content is written entirely in Japanese and does not offer any language choice or explain a region-specific requirement. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.