Security audit

Corporate Banker Digital Employee

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a banking workflow reference, but it mixes no-tool/reference-only claims with instructions for sensitive bank-system queries and credit-application submission steps.

Install only in an authorized banking environment. Treat all API names, case IDs, audit records, and submission steps as checklist guidance unless your institution has explicitly approved scoped tools and human review gates. Do not let the agent directly query credit, transaction, archive, registry, or case-management systems without separate authorization and explicit user confirmation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest advertises no-tool permission required and a human-executed reference workflow, yet the body repeatedly instructs reading internal archives, querying banking systems, using crawlers, and checking sensitive registries. In environments that ingest skill metadata for policy decisions, this mismatch can bypass review gates, causing unauthorized access patterns, privacy violations, or unsafe deployment of a skill that appears non-operational but contains operational instructions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The top-level boundary text says API names are illustrative labels only and no system access occurs, but multiple embedded audit examples elsewhere describe 'ai' as the executor of system queries. This contradiction can cause an orchestrator, reviewer, or downstream agent to over-trust the document and perform sensitive internal lookups under the false assumption that such access is intended and approved.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The top-level security boundary repeatedly states that the skill is only a reference workflow, does not call systems, and that phrases like '提交成功' and '案件编号' are merely descriptive placeholders. However, Module 8 explicitly says it will '发起授信审批流程', '发起案件创建', and its audit example records a generated case_id, which directly contradicts the earlier boundary statements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The top-level description is entirely in Chinese and presents the skill as a broad end-to-end workflow for corporate bankers, but nowhere in the document does it offer a user language preference or state that the skill is intentionally restricted to a Chinese-speaking or China-only operating context. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Throughout the markdown, output templates, section titles, prompts, and examples are written as mandatory Chinese-language artifacts, but the skill never gives users a choice of output language. Because this file applies across multiple modules and output formats, the language assumption is operationally enforced rather than merely illustrative.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.