public-company-analysis

• Outcome: Pass
• Latest audit: May 28, 2026 at 10:33 AM UTC
• Version:
  1.0.0

Overview

This skill is an instruction-only public-company research template that uses public financial sources and does not request account access, trading authority, local files, or persistence.

Install this if you want a structured public-company analysis assistant. Expect it to browse public financial, filing, news, and sentiment sources; verify figures and assumptions independently, and do not treat its output as personalized investment advice.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The activation triggers include broad investment-advice phrasing such as "Is [company] a good buy right now?", which can cause the skill to activate on general advice-seeking queries rather than only on explicit requests for structured company research. In a finance context, that increases the chance the agent will provide regulated or high-stakes guidance without sufficient scoping, disclaimers, or user confirmation, especially when combined with instructions to immediately start the skill.

VirusTotal

66/66 vendors flagged this skill as clean.