Security audit

wealth-management

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent wealth-management skill, but it handles sensitive financial information and documents optional Notion write-outs without clear consent, privacy, or scoping controls.

Review this skill before installation if you expect it to process real client or household financial data. Use local Markdown output by default, and only allow Notion export after confirming the workspace, destination page/database, exact fields, client consent, redaction needs, and organization policy. Treat China-specific tax, pension, and market assumptions as jurisdiction-limited and have regulated advice reviewed by a qualified professional.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Several trigger keywords are very broad, common phrases such as '客户报告', '行情分析', '财务规划', and '节税', which are likely to appear in normal discussion without intent to invoke a specialized skill. Because this skill operates in a wealth-management context involving sensitive financial data and advisory outputs, keyword collisions increase the risk of accidental routing, over-collection of personal data, or unreviewed investment/tax recommendations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation guidance says users can trigger the skill through natural conversation and automatic matching, but it does not define strict routing boundaries or disambiguation rules. In a financial-advice skill, this can cause accidental invocation on ordinary conversation, leading to unintended handling of sensitive financial context or generation of regulated advice when the user did not explicitly request it.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description embeds many broad, conversational trigger phrases such as '帮我看看…', '客户报告', and '帮我做个…方案', which can cause the router to activate this wealth-management skill for loosely related user requests. In a finance context, misrouting is security-relevant because it can lead to collection of sensitive financial data, generation of regulated advice, or inappropriate tool/template execution under the wrong intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file presents all instructions, inputs, and outputs exclusively in Chinese and does not state that the skill is region-specific or provide any option for another language. This can violate a language/locale policy when users have not explicitly opted into Chinese-only interaction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly promotes writing client reports to Notion but provides no privacy, consent, retention, or access-control guidance for transmitting sensitive client financial information to an external SaaS platform. In a wealth-management context, these reports can contain personally identifiable and highly sensitive portfolio data, so silent syncing increases the risk of unauthorized disclosure or regulatory noncompliance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The workflow instructs users to upload Excel/CSV files containing client holdings and valuation data without any warning about secure handling, validation of sensitive content, or limits on downstream use. Because this skill processes wealth-management records, the omission increases the chance of accidental overcollection, insecure storage, and exposure of account-level financial data during analysis or connector use.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest describes a wealth-management skill focused on fund analysis, client reporting, market snapshots, financial planning, tax planning, and asset allocation. Referencing "investment-banking" for high-net-worth comprehensive reporting introduces a materially different business capability that is not justified by the stated purpose of this client reporting workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This second Notion connector section again describes syncing client reports and portfolio summaries to an external platform without any security or compliance caveats. Repetition of the unsafe pattern in connector documentation makes the issue more dangerous because it normalizes external sharing of sensitive investment data as a default operational step.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The document provides detailed financial, pension, social security, and tax guidance that is clearly specific to PRC policy, but the top-level framing does not clearly restrict applicability to China. A user in another jurisdiction could rely on incorrect assumptions, formulas, deduction rules, or retirement policy parameters, leading to materially wrong planning outputs and unsafe financial decisions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly supports writing comprehensive financial plans to Notion, and those plans include highly sensitive personal financial data such as income, debts, assets, ages, insurance gaps, and tax details. Without a clear warning, explicit consent step, and data-minimization guidance before using the external connector, users may unknowingly transmit regulated or highly confidential data to a third-party service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The title and all operational instructions are written as a Chinese-only skill specification, and nowhere in the file does it offer users a language/locale choice or state that the skill is limited to a China-specific audience for compliance reasons. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill advertises a Notion connector that can write analysis reports and screening results into an external workspace, but it does not require explicit user confirmation, preview the content to be written, or warn that external data will be modified. In a financial context, this can lead to unintended disclosure of sensitive portfolio analysis or accidental persistence of incorrect data into a user-controlled system.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill title and all operational instructions are written exclusively in Chinese, and the specified output format is also entirely Chinese. There is no indication that users may choose another language or that the locale restriction is intentionally limited to a China-specific compliance or regional use case.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The guidance includes actionable allocation suggestions such as increasing equity exposure or reducing positions based on generated valuation signals, while only providing a brief disclaimer. In a wealth-management context, this can cause users to treat model-generated output as personalized or quasi-authoritative investment advice, increasing the risk of harmful financial decisions, suitability issues, and regulatory noncompliance.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill title and core description are written entirely in Chinese and present the capability as a default Chinese-language tax-planning skill. There is no indication that the user can choose another language or that the Chinese-only locale is an explicitly documented regional constraint, which makes this a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest scopes the skill to wealth management use cases such as fund analysis, client reports, market snapshot, financial planning, tax planning, and asset allocation. This reference file extends the skill’s use to 'investment-banking' and '投行客户', which is a different business context and not obviously necessary for the declared wealth-management purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest describes this skill suite as providing market snapshots and related wealth-management analysis outputs, which is consistent with generating reports. However, this file explicitly documents an optional connector capability to write reports into Notion for archival, which is an external persistence/integration behavior not reflected in the stated description of the market snapshot capability itself.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The document states at L009 that the skill can be fully used without connectors based on built-in tax knowledge, which frames it as a self-contained advisory capability. However, L216-L220 adds a Notion connector that writes tax plans and calculation workpapers to an external system, expanding actual behavior beyond the earlier self-contained description.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.