Security audit

Investment Researcher Digital Employee

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a financial research template, but it understates its own external data-querying and scheduled-report behavior, so it belongs in Review before installation.

Review this skill before installing. It should only be used where you are comfortable with an agent querying your authorized financial data services or public web sources, and it should ask before saving, sending, or setting up any recurring report workflow. Treat all outputs as drafts requiring qualified human review.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest claims the skill only provides methodology/report frameworks and that users fetch data in their own authorized services, but the body instructs direct tool-based retrieval from external data/search systems. This mismatch can cause the host agent or reviewer to grant trust or permissions under false assumptions, leading to unintended outbound queries and processing of sensitive financial data.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The security notice says there are no network calls, no persistent storage, and no automatic reading/writing of user data, yet later sections instruct querying external data services and writing files after confirmation. Such contradictory assurances undermine security review and may bypass policy gating by presenting active behaviors as passive documentation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The global strategy says the skill does not connect to data sources or auto-fetch data, but the modules repeatedly direct direct querying through external tools. This creates a deceptive capability boundary that can make operators believe the skill is safer and less privileged than it really is.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill includes instructions for automatic scheduled report generation despite being described as advisory-only and framework-focused. Scheduled execution increases the chance of unattended data access, recurring report production, and drift into autonomous behavior without fresh user review.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Weekly auto-generation guidance similarly promotes recurring unattended behavior that is inconsistent with the stated framework-only role. In a financial research context, this can lead to stale assumptions, unauthorized repeated data pulls, and unintended dissemination of generated reports.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger list includes generic phrases such as “分析 XX 行业” and “帮我深度研究一下 XX 行业”, which are broad enough to overlap with ordinary conversation rather than a narrowly scoped skill invocation. The file does not provide exclusion conditions or negative examples to clarify when these phrases should not activate this module.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Phrases like “快速分析 XX 行业”, “XX 行业速评”, and “XX 行业简单分析” are ambiguous and may match many routine user requests. The section does not define scope limitations or examples of requests that should route elsewhere, increasing the chance of unintended invocation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger examples include broad formulations such as “快速分析 XX 公司”, “XX 公司速评”, and “XX 公司核心要点”, which can easily appear in everyday requests. Without exclusion criteria or stronger context limits, these phrases may activate the skill when the user did not intend a formal one-page investment analysis.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.