Security audit

Bank Regulatory Reporting

Security checks for vulnerabilities and agentic risk

Overview

This is a conversation-only banking report drafting skill with sensitive-domain use, but I found no hidden execution, persistence, credential use, or data exfiltration behavior.

Install only in an approved environment for regulated bank data. Avoid pasting production customer, transaction, AML, or confidential financial data unless your organization permits it, and prefer redacted or aggregated inputs. Treat generated reports as drafts that require review by authorized compliance staff before filing.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README explicitly markets generation of AML, NPA, and banking regulatory reports from raw data, which strongly implies processing highly sensitive customer, financial, and compliance information. The absence of any guidance on confidentiality, access control, retention, redaction, or approved deployment boundaries creates a real risk that users will expose regulated banking data to an AI workflow without understanding the security and compliance requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: All listed triggers are Chinese-only, and the example prompts and workflow are written primarily for Chinese-language interaction. While the domain may be China-focused, the file does not explicitly state that the skill is region-specific or that users may choose their preferred language, which can violate language/locale choice policy.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The trigger list uses generic compliance/reporting phrases such as '监管报告', '统计报告', and '合规报告' that are broad enough to activate this skill for many unrelated banking or compliance requests. In an agent environment, this can cause incorrect skill routing, unnecessary exposure of domain-specific workflows, or interference with more appropriate skills, especially because the skill handles sensitive regulatory-reporting contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger list is broad enough to activate on ordinary banking, compliance, or reporting discussions rather than only explicit invocations of this skill. In a high-sensitivity domain like banking regulatory reporting, unintended activation can expose users to unvetted guidance, cause workflow confusion, or steer regulated tasks through the wrong skill without clear consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The README is bilingual, but the skill is explicitly framed around Chinese regulatory reporting and includes Chinese-only regulatory/report labels in several places. It does not state whether the skill requires Chinese output or offer users a language/locale option, which may constitute an undocumented locale constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.