Security audit

Investment Research

Security checks for vulnerabilities and agentic risk

Overview

This investment-research skill is mostly coherent, but it includes optional Notion publishing of potentially sensitive financial research without enough top-level disclosure or export safeguards.

Review before installing if you handle confidential research, expert-interview notes, unpublished financials, or regulated information. Use it only where Notion export is acceptable, and require explicit destination, permission, redaction, and compliance review before allowing any write to a shared knowledge base.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Several trigger keywords are overly generic, such as '晨会', '10-K', 'comps', '产业链', and '专家访谈', and are not constrained to this skill's specific workflow. These broad terms increase the chance of false routing, especially in enterprise environments where similar phrases may arise in unrelated contexts, causing unintended access to the skill's research workflows or accidental ingestion of sensitive files.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README states that users can trigger the skill through natural conversation and that matching happens automatically, but it does not describe any scoping, confirmation, or disambiguation controls. In a multi-skill environment, broad natural-language activation can cause unintended invocation on sensitive financial-analysis tasks, leading to accidental processing of documents or generation of investment research when the user intended a different action.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description advertises many short, common trigger phrases such as generic requests to analyze reports or industries, which are broad enough to match normal conversation outside the intended workflow. This can lead to accidental invocation and over-collection or over-processing of user-supplied documents in contexts where the user did not clearly request this specific skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description and all user-facing instructions are written exclusively in Chinese, presenting the skill as a Chinese-language investment research package without any opt-in or alternative language handling. Under the policy, a skill should not impose a specific language or locale unless it explicitly offers a choice or clearly documents a justified regional constraint.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The routing logic matches any user input containing listed keywords or loosely described scenarios, which can cause unintended activation on ordinary finance-related phrases. In a skill that then mandates loading and strictly following downstream templates, overbroad triggering increases the chance of misrouting user requests, inappropriate data handling, or execution of the wrong workflow without clear confirmation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill title and operating instructions are entirely in Chinese and do not indicate that users may choose another language or locale. Under the policy for natural-language violations, a skill that effectively mandates a specific language without opt-in should be flagged unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The quality standards require output to follow Chinese broker report conventions, use CAS financial statement structure, use Shenwan industry classification, and avoid certain non-Chinese analytical terminology as the primary framework. This imposes a specific language/locale and market convention by default, with no user opt-in or alternative locale choice documented.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The connector section explicitly states that the skill can write deep research reports into a Notion knowledge base for team collaboration and knowledge retention. Persistent export to an external SaaS workspace goes beyond the manifest's stated analytical functions, which describe research generation tasks but not storage, synchronization, or third-party publishing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The instruction "按中国券商研报体例输出点评" forces a specific language/locale/style tied to Chinese market practice. The file does not offer the user a language or locale choice, nor document a justified region-specific constraint, so it fits the policy category for locale/language restrictions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest scope for 调研纪要 is to produce research notes from field research, site visits, and expert interviews. In this file, the workflow explicitly adds an '投资要点提炼' step that interprets the notes against market expectations and derives investment implications, which is a broader analytical function than merely standardizing or summarizing notes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Writing field-research notes to Notion is a material external publishing action involving potentially confidential, non-public, or regulated financial information. In this skill context, that is more dangerous than ordinary note export because the document itself acknowledges possible内幕信息 and sensitive company data, so unintended synchronization to a shared workspace could cause data leakage, compliance breaches, and insider-information exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The title and the entire skill specification are written as a Chinese-only reporting workflow, and the quality standard at L164 anchors it to a Chinese industry classification system. There is no indication that the user may choose another language for the report, which can violate a language/locale choice policy when applied broadly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill content is entirely in Chinese and presents output and workflow requirements only in Chinese, with no indication that language should follow the user's preference. This can force Chinese-language operation even when the user interacts in another language, creating usability and comprehension risks that may lead to misunderstood financial analysis or missed warnings.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instruction "直接上传研报即可开始" is an overly broad activation cue that can cause the skill to trigger on vague or minimally specified user input without clear confirmation of scope. In a multi-skill agent, ambiguous activation increases the chance of unintended invocation, misrouting sensitive financial documents, or processing content the user did not explicitly mean to analyze with this skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: L005将数据来源限定为“用户上传文件”，但L119提到“如有MCP数据”可用于历史分红趋势，L127-L128与L214又描述了与Notion连接进行外部写入。这说明技能并非仅围绕用户上传文件进行封闭式本地分析，文档对能力边界表述略显过窄。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: L016表示用户只需上传年报即可开始，暗示该输入足以支撑技能目标；但后文在L036-L037、L119-L120、L205明确要求补充往年报表、股价或行业分类，才能完成历史对比、股息率或行业特化分析。这不是单纯实现细节，而是对输入充分性的描述与实际分析能力之间存在轻微不一致。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instruction "不得使用"Non-GAAP"等英文术语，统一用"扣非归母"" imposes a specific language/terminology policy. The file does not offer the user a language or locale choice, so this is a natural-language policy constraint that may conflict with organizational language-choice requirements.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest describes analytical research outputs such as earnings commentary, comparable-company analysis, annual report reading, and deep-dive reports. Lines L106-L108 add a capability to ask whether the report should be written into Notion, which is a knowledge-base integration rather than an obvious requirement of producing investment research itself.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file introduces writing research notes into Notion even though this capability is not clearly represented in the manifest description. Hidden or under-declared external write behavior is dangerous because users may provide sensitive research, MNPI, or confidential company information without understanding that it could be persisted to a third-party workspace.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The Notion-writing instructions lack a clear privacy and data-sharing warning at the point of export. Because this skill processes research interviews, company discussions, and potentially non-public financial details, omission of a prominent disclosure increases the risk that users will unknowingly share sensitive information into broader team spaces or externally accessible systems.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: 技能清单将该技能描述为投研分析与晨会纪要生成，主体流程也围绕整理素材、提炼观点和生成汇报材料展开。但这里额外提出在已连接 Notion 时可将纪要写入知识库，这属于持久化/外部系统写入行为，不是晨会纪要生成本身的必然组成部分。
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs the agent to offer writing morning-briefing content into Notion, but it does not warn that the content may contain sensitive internal research, market views, or proprietary '[调研]' notes that would then be shared with and persisted in a third-party system. In this investment-research context, that omission can lead to unintended data exposure or retention beyond the user's expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.