Security audit

Finance Training Coach

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a training aid, but it includes under-scoped examples that could make an agent generate real investment advice.

Review this skill before installing if your environment has policies around regulated financial advice. It appears non-executable and does not request system access, but users should keep it limited to training, use fictional or synthetic examples where possible, and avoid relying on it for personalized recommendations, buy/sell/hold conclusions, suitability judgments, or handling real employee/customer data without internal approval.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The markdown explicitly defines activation keywords such as "training system," "skill assessment," and especially the Chinese triggers "培训 / 陪练 / 考核 / 测验," which are generic phrases that can appear in many ordinary workplace requests. The file provides examples, but it does not define boundaries, exclusion conditions, or a narrow invocation context, so the trigger scope remains too broad for reliable activation.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill claims to be for educational/training use, but adjacent content expands into generating investment-related course material and examples that can steer users toward actionable financial recommendations. That mismatch can cause the agent to be used as a de facto advisory tool without the controls, licensing, or suitability checks required for financial advice.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The 'advanced strategy' and related curriculum content broadens the skill from employee training into investment-analysis and strategy-generation territory. In context, a user could invoke these capabilities to obtain substantive investing guidance under the cover of a training tool, bypassing governance expectations for regulated financial outputs.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The assessment examples explicitly ask learners to analyze real company financials and provide investment advice, which exceeds a training-only role and directly facilitates actionable recommendations on actual securities. This is especially risky because the examples normalize producing advice-like outputs that users may treat as trustworthy despite the 'training' label.

Static analysis

No suspicious patterns detected.