Security audit

Pensions

Security checks for vulnerabilities and agentic risk

Overview

This is a simple Chinese-language pension planning skill with sensitive finance-oriented outputs, but no code, install steps, persistence, credential handling, or automatic account actions were found.

Before installing, treat this as a financial-planning helper rather than an authorized account-management tool. Only provide transaction, statement, tax, billing, or holdings data when you intentionally ask for account-specific analysis, and do not let it initiate transfers or account changes without separate trusted controls.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill metadata says it provides pension analysis, account simulation, retirement income estimation, and portfolio suggestions, but the body expands into operational/financial-account capabilities such as transaction history, statement export, tax details, and near-real-time syncing with personal billing changes. This materially broadens the data and action surface into highly sensitive financial information and possible account-operation workflows without clearly scoped authorization, consent, or guardrails, increasing the risk of over-collection, unintended access, and misuse.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The example trigger phrases are very broad and overlap with normal conversational wording, which can cause accidental invocation of a financial skill in unrelated contexts. In a domain involving investments and personal financial records, misrouting user queries can expose sensitive data, produce unintended advice, or activate workflows the user did not mean to invoke.

Natural-Language Policy Violations

Low

Confidence: 81% confidence
Finding: 该文件中的技能名称、描述及交互示例全部固定为中文，且未说明是否支持用户选择其他语言或按用户偏好切换语言。根据语言/区域政策，若技能默认强制某一语言而未提供选择或明确的适用范围，可能构成自然语言层面的策略问题。

Static analysis

No suspicious patterns detected.