Security audit

Portfolio Tool-基金组合研究工具

Security checks across malware telemetry and agentic risk

Overview

This portfolio skill mostly matches its stated purpose, but it uses a persistent machine-derived identifier and broad backend access in ways users should review before installing.

Review whether you are comfortable with this skill creating a stable device-derived ID, storing it at ~/.portfolio/aid, and sending it to the configured portfolio backend. Prefer using a trusted HTTPS backend, avoid reusing important passwords for the bind/login feature, and treat the fallback pf.py script as a broad backend client rather than a narrowly limited portfolio command.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill instructs the agent to read environment variables, access local files such as ~/.portfolio/aid, write persistent identity data, and make network requests, yet it declares no permissions. This creates a transparency and consent gap: users and hosting platforms may not realize the skill can access sensitive local state and exfiltrate it to a remote backend.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The declared purpose is a conversational portfolio tool, but the skill also prescribes machine fingerprint generation, persistent host-level identifier storage, and a generic REST fallback that can target arbitrary API paths. That broader behavior expands the attack surface beyond what a user would reasonably expect and can enable privacy-invasive tracking or unintended backend actions.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script derives a stable identifier from machine characteristics and persists it for reuse, creating a cross-session tracking token tied to the host. That exceeds the apparent need of a simple portfolio CLI and can expose device-level identity to the backend or any configured remote endpoint, especially since users are not clearly informed or asked to consent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs the client to derive a stable machine fingerprint from OS-level identifiers, persist it, and send it as an identity header, but it provides no meaningful privacy warning or consent flow. A persistent cross-session device identifier can enable long-term tracking, accidental account linkage across users on the same machine, and collection of host-specific attributes without user awareness.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The skill instructs users to send usernames and passwords to backend bind/login operations without clearly warning about credential handling, storage expectations, or transport risks. Even if HTTPS is intended, lack of explicit guidance increases the chance of unsafe use, credential reuse exposure, or accidental transmission to an untrusted/local misconfigured endpoint.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: A stable machine-derived identifier is generated and automatically transmitted in the X-Anonymous-Id header without any user-facing notice. This enables silent correlation of activity across sessions and potentially across servers if PORTFOLIO_API is changed, creating a privacy and tracking risk disproportionate to the tool's conversational portfolio purpose.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The tool writes the generated identifier to ~/.portfolio/aid without explicit warning, creating persistent local state that users may not expect. While lower impact than transmission, this still affects privacy and can complicate cleanup, consent, and multi-user/shared-system behavior.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.