Security audit

Thesis Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently tracks investment theses, with disclosed local persistence and optional knowledge-base style note creation, but users should be aware it stores financial views across sessions.

Install only if you want investment theses saved persistently. Avoid recording private positions or strategies unless you are comfortable with them being stored in thesis-tracker/theses.json and possibly mirrored into IMA notes; review and delete those records when no longer needed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README explicitly states that thesis data is persisted to a local JSON file and that new theses are automatically synchronized to a knowledge base, but it does not warn the user or request consent. This creates a privacy and data-governance risk because investment views, assumptions, and tracking notes may be sensitive and could be retained or shared externally without the user's awareness.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough to match ordinary conversation such as asking to '记一下' or '验证XX观点', which can cause the skill to activate without clear user intent. In this skill, unintended activation is more dangerous because it can create or update persistent thesis records and may trigger downstream data checks or knowledge-base synchronization.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrases are broad enough to match ordinary investing conversations, which can cause the skill to activate when the user did not intend to start persistent thesis tracking. In this skill’s context, unintended activation is more dangerous because activation leads directly to storing structured investment theses and later follow-up behavior, creating privacy and consent risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to write thesis data to a local JSON file and create IMA notes without notifying the user or obtaining consent for persistent storage. This is dangerous because investment theses may contain sensitive financial views, positions, or strategy notes, and silent retention can expose private data across sessions or to other tools with filesystem/note access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: All user-facing invocation guidance and behavior description are presented in Chinese, which effectively constrains the skill to a specific language without documenting that choice or offering alternatives. Under the policy, language constraints should be opt-in or explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The entire skill description, examples, and outputs are written as Chinese-only instructions, and there is no indication that the user may choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.