investment-banking

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:09 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent investment-banking drafting suite, but it can persist confidential deal materials and reusable rules to shared systems without clear per-action approval.

Install only if users understand this is for sensitive financial and regulatory drafting. Require human review before relying on outputs, disable or tightly control Notion writes unless the destination workspace is approved, and do not allow engagement-specific corrections to update shared templates or compliance checklists without an explicit review process.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

other

Warning

• Location: references/bond-offering.md:144

Finding

External Persistence of Confidential Financial Documents Without Explicit User Confirmation

Content

View full analysis

Vulnerability Details

File Locations:

• references/bond-offering.md:144-146
• references/financial-modeling.md:163-165
• references/ma-advisory.md:142-144
• references/prospectus.md:132-134
• references/regulatory-response.md:115-117
• references/roadshow-materials.md:120-122

Vulnerability Type: Unconfirmed external data persistence
Risk Level: Medium

Vulnerable Instructions

The following complete instruction pattern appears in each affected template, with the document type adjusted to the relevant workflow:

markdown

**If Notion is connected:**
- Write the generated document or analysis to the Notion knowledge base.
- Organize the content for team collaboration and review.

**If Notion is not connected:**
- Return the complete content so the user can organize or copy it manually.

Specifically, the templates direct the agent to upload:

• Bond offering memorandum drafts at references/bond-offering.md:144-146
• Financial assumptions and valuation summaries at references/financial-modeling.md:163-165
• Mergers and acquisitions report drafts at references/ma-advisory.md:142-144
• Prospectus chapters at references/prospectus.md:132-134
• Regulatory response drafts at references/regulatory-response.md:115-117
• Roadshow outlines, scripts, and investor questions and answers at references/roadshow-materials.md:120-122

Technical Analysis

The templates treat the availability of a Notion connection as sufficient authorization to persist generated content externally. They do not require the agent to obtain operation-specific user consent immediately before writing, identify the target workspace or page, verify destination access controls, classify the information, or redact confidential fields.

The affected workflows process potentially sensitive information, including non-public financial statements, issuer details, transaction terms, valuation assumptions, r ...[truncated 1885 chars]

Remediation

View remediation

Remediation Suggestions

1. Make local or conversational output the default for every workflow.
2. Require explicit user confirmation immediately before each external write.
3. Present the exact destination workspace, database, page, and content scope in the confirmation prompt.
4. Require the user to approve whether source data, generated analysis, or only a redacted summary will be uploaded.
5. Add a data-classification check for confidential, regulated, personal, and material non-public information.
6. Redact unnecessary identifiers, account details, transaction terms, and non-public financial data.
7. Verify destination membership, sharing settings, inherited permissions, integrations, and retention policy before writing.
8. Offer a dry-run preview showing the exact content and destination without performing the write.
9. Record an audit event containing user approval, destination, timestamp, and content classification.
10. Refuse external persistence when destination ownership or access controls cannot be verified.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:100

Finding

Engagement-Derived Content Can Poison Persistent Shared Templates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:100
Vulnerability Type: Persistent memory and shared-template poisoning
Risk Level: Medium

Vulnerable Instruction

English rendering of the complete instruction at the identified location:

markdown

| 6. Retrospective persistence | Newly added | Convert corrections from the current prospectus or due-diligence report into investment-banking methodology, update the document template library and regulatory compliance checklist, and create reusable verification checklists. |

Technical Analysis

The instruction directs the agent to transform corrections from the current engagement into persistent methodology, document templates, compliance checklists, and reusable verification rules. It does not establish human approval, trusted-source validation, provenance tracking, tenant isolation, sanitization, version control, or rollback requirements.

Because current engagement material is at least partly user-controlled, a user can introduce a misleading correction, fabricated regulatory requirement, client-specific exception, or strategically crafted instruction. If the retrospective step treats it as reusable methodology, the content can persist beyond the current session and influence future engagements.

The same mechanism can also transfer client-specific or confidential conclusions into a shared template library. The vulnerability therefore affects both integrity and confidentiality across sessions. The finding does not demonstrate that a storage backend is implemented in this repository; it identifies an explicit instruction to update persistent resources when such facilities are available.

Attack Path

1. A user supplies source material containing a misleading correction, false compliance rule, or client-specific exception.
2. The agent uses that content during the current prospectus or due-diligence engagement.
3. During the retrospective persistence ...[truncated 1095 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic modification of shared templates and compliance checklists.
2. Replace the persistence step with generation of a proposed change set that is not applied automatically.
3. Require approval from an authorized human reviewer before any persistent update.
4. Record the source engagement, source document, author, date, rationale, and supporting regulatory authority for each proposal.
5. Validate proposed compliance rules against trusted and current primary regulatory sources.
6. Strip client names, transaction details, financial figures, and other engagement-specific information before reuse.
7. Isolate knowledge by organization and engagement unless an explicit promotion process approves broader use.
8. Apply version control, change review, integrity checks, and rollback to all template and checklist updates.
9. Prevent user-provided instructions from being promoted as methodology without independent verification.
10. Periodically review persistent rules for expiration, superseded regulations, and cross-client contamination.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Several trigger keywords are generic domain terms such as '并购', 'IPO', '路演', and '反馈意见', which can appear in ordinary discussion rather than as explicit requests to invoke a skill. Because this skill operates in a sensitive financial and regulatory domain, broad keyword overlap increases the chance of misrouting conversations into automated drafting flows that may expose confidential deal work or produce unreviewed compliance-relevant output.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation guidance '通过 Marvis 对话自然触发，说出需求即可自动匹配对应子技能' is very broad and implies free-form natural language routing without clear guardrails. In a high-stakes investment-banking context, this can cause accidental invocation of drafting or analysis workflows on ambiguous user requests, leading to unintended generation of regulated financial content or disclosure-sensitive materials.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases listed in the description are broad terms such as IPO, 路演, 并购, and 财务建模, which can appear in many informational or exploratory requests unrelated to full workflow execution. This increases the chance of accidental activation and misrouting, especially because the skill is designed to generate compliance-sensitive banking materials where mistaken execution can lead to misleading outputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description and operational instructions are written entirely in Chinese and present the skill as a Chinese-language workflow, with no indication that users may choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The routing logic activates a sub-skill whenever user input merely contains listed keywords or loosely described scenarios, with only a vague 'highest match' fallback. In a high-stakes investment-banking context, generic financial phrasing can easily trigger the wrong workflow, causing the agent to produce regulated documents or advice under incorrect assumptions without sufficient confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that key assumptions and valuation summaries may be written to Notion, but it does not require explicit user consent, warn that uploaded financial data may be transmitted to an external service, or describe retention/persistence risks. In an investment-banking context, these materials can contain confidential financials, forecasts, and deal-sensitive information, so silent export to a third-party workspace creates a real confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file's headings, instructions, confirmations, and output format are all presented in Chinese, and there is no statement that the user may choose another language. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file is entirely written as a Chinese-only workflow for generating an IPO prospectus draft, including fixed Chinese section headings and output format. There is no indication that users may choose another language or that the language restriction is an explicit opt-in, which matches the policy category for locale/language constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The title and the entire skill specification are written as a Chinese-only workflow for drafting regulatory responses, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

技能清单中的“债券募集”描述主要聚焦于起草债券募集相关文档与分析内容，而此处额外声明了将生成结果写入 Notion 知识库、创建目录结构的文档发布能力。该行为超出了单纯生成募集说明书的语义范围，属于额外的内容发布/协作集成能力。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill describes writing generated bond-offering drafts into Notion without any warning about handling confidential issuer financials, offering terms, ratings, or transaction materials. In an investment-banking context, these documents commonly contain MNPI, client-confidential data, or regulated disclosure content, so sending them to a third-party workspace without explicit privacy controls can cause unauthorized disclosure or compliance breaches.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown skill specifies all instructions, prompts, and output structure in Chinese, and does not indicate that users may choose another language. Under the policy category, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.