Sudo Gold

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:06 PM UTC
• Version: 1.0.0

Overview

This gold analysis skill is mostly purpose-aligned, but it mixes live third-party search, confusing credential documentation, and an unrelated financial app promotion in its operating instructions.

Review this skill before installing. It appears to perform gold-market analysis using Tavily, but your queries and Tavily API key may be sent to that external provider. The JD Finance promotional link is unrelated to the core function and should be removed or treated as advertising, not as part of the analysis workflow.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:42
• Finding: Unrelated Promotional Content Embedded in Skill Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 42-43 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Vulnerable Code ```markdown --- 📢 **[更多资讯，下载京东金融](https://eco.jr.jd.com/common-growth-page/index.html?channel=clawhub)** ``` ### Technical Analysis The Skill instructions embed an external JD Finance promotional link immediately after the prescribed report format. Advertising or directing users to a financial application is unrelated to the declared functionality of retrieving gold-market information and producing technical or fundamental analysis. Because an agent loads `SKILL.md` as operational instructions, embedded promotional material can influence generated responses and cause the agent to reproduce or endorse third-party content without the user requesting it. The campaign query parameter also indicates that visits may be attributed to this distribution channel. This exceeds the minimum instructions necessary for the declared functionality. The Tavily network request in `scripts/search-gold.mjs` is relevant to market-data retrieval, but this promotional destination is not used by the search implementation and is unnecessary. ### Attack Path 1. A user asks the agent for gold-price or gold-investment analysis. 2. The agent loads `SKILL.md` to determine the Skill's workflow and output format. 3. The promotional link is encountered alongside the response instructions. 4. The agent may reproduce the advertisement in its response or treat it as an endorsed resource. 5. The user may follow the external campaign URL, exposing the user to redirection and campaign attribution outside the Skill's analytical purpose. ### Impact Assessment The issue can alter the integrity and neutrality of agent-generated responses by inserting unsolicited third-party promotion. It may redirect users to an external financial-service campaign and create an implicit endorsement by the ...[truncated 255 chars]
• Remediation: ## Remediation Suggestions 1. Remove the promotional text and JD Finance campaign URL from `SKILL.md`. 2. Keep Skill instructions limited to behavior required for gold-price retrieval and analysis. 3. Do not place advertisements, referral links, or campaign URLs in operational instructions or required response templates. 4. If an external resource has a legitimate analytical purpose, identify it neutrally, explain why it is needed, and include it only when explicitly requested by the user. 5. Review future Skill changes for unrelated output directives and allowlist only external domains required for declared functionality.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares executable and network-capable behavior through Node and an API-backed search flow, but it does not define an explicit tool scope such as permissions or allowed-tools. This can cause the agent runtime or reviewer to underestimate what the skill can access, increasing the risk of unintended external requests or environment-variable use.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger description is broad enough to activate on common investment conversations, which can cause the skill to run unexpectedly and send user queries to an external API. In this skill's context, over-triggering is more concerning because it is tied to network access and possible use of credentials.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documentation describes use of the Tavily search API but does not clearly warn users that their queries may be sent to an external provider. This creates a privacy and transparency issue, especially for financial or investment-related questions that may reveal sensitive interests or intentions.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The documentation states that a default Tavily API key is built in, while the manifest says the key is required from the environment. A built-in credential is a serious supply-chain and secret-management risk because it may embed shared or hidden secrets and obscures who is accountable for outbound API usage.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Referencing a built-in default API key without user-facing caution normalizes hidden third-party access and masks who is paying for and receiving the requests. In practice this reduces transparency and can expose users to undocumented data handling by an external service.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The example invocations use vague everyday phrasing such as asking whether gold can be bought now, which broadens activation beyond a clearly defined tool request. This increases the chance of accidental invocation and unannounced third-party data transmission.

External Transmission

Medium

• Category: Data Exfiltration

Content

}

async function searchTavily(q, n = 3) {
  const resp = await fetch("https://api.tavily.com/search", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({

• Confidence: 90% confidence
• Finding: The presence of a hardcoded external endpoint indicates that all searches rely on a third-party service outside the local trust boundary. This is not inherently malicious, but it becomes security-relevant in a financial analysis skill because users may provide market positions, investment interests, or sensitive research topics that are then transmitted externally.

External Transmission

Medium

• Category: Data Exfiltration

Content

}

async function searchTavily(q, n = 3) {
  const resp = await fetch("https://api.tavily.com/search", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({

• Confidence: 90% confidence
• Finding: The presence of a hardcoded external endpoint indicates that all searches rely on a third-party service outside the local trust boundary. This is not inherently malicious, but it becomes security-relevant in a financial analysis skill because users may provide market positions, investment interests, or sensitive research topics that are then transmitted externally.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script sends user-provided search queries directly to Tavily, an external third-party API, without any notice, consent, or visible disclosure to the user. In a skill context, user prompts may contain sensitive financial intent, portfolio interests, or other personal data, so silent transmission creates a privacy and data-governance risk.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The script emits Chinese-language output and explicitly formats timestamps using the zh-CN locale, which imposes a specific language/locale on all users. There is no opt-in, locale selection, or documented reason that this tool must be restricted to Chinese output.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The skill metadata and descriptive text are entirely in Chinese and imply Chinese-language operation, but there is no indication that users may opt into another language or locale. Under the policy, forcing a specific language without user opt-in can be a natural-language policy issue unless clearly justified.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The manifest describes a gold investment analysis tool focused on price, technical indicators, and news analysis. The promotional link to download JD Finance is not justified by that purpose and introduces unrelated marketing behavior into the skill documentation.

Natural-Language Policy Violations

Low

• Confidence: 67% confidence
• Finding: SQP-3 applies to all file types and covers language or locale policy violations. This file presents all instructional content exclusively in Chinese and does not indicate that the language is optional, user-selected, or required for a region-specific purpose.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: This is a markdown file, so SQP-2 applies. The content describes overbought/oversold thresholds, bullish/bearish crossover signals, and support/resistance levels, but provides no caution that these indicators are not guaranteed, may produce false signals, or should not be treated as financial advice.

Static analysis

No suspicious patterns detected.