Security audit

Investment Researcher Digital Employee

Security checks across malware telemetry and agentic risk

Overview

The skill is a financial research assistant, but its own instructions under-disclose external data access, code execution, and recurring scheduled jobs.

Review before installing. This skill appears intended for legitimate investment research, but users should treat it as a networked, tool-using research automation skill rather than a passive reference framework. Only enable it where external financial/news queries, sandboxed Python analysis, and any scheduled briefings are explicitly allowed and controlled by the user.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The skill claims it makes no network calls, but the body repeatedly instructs use of remote services such as web_search and gildata-aidata. This is a trust-boundary violation: operators or users may rely on the disclaimer when approving the skill, while the actual behavior can exfiltrate prompts or fetch external data unexpectedly.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The top-level notice says there is no background execution, but later sections describe scheduled and recurring automated runs. This creates a misleading security posture and can cause reviewers to underestimate autonomous behavior, including repeated execution and unattended data processing.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: Module 8 advertises timed automatic generation even though the skill-level notice denies background execution. The contradiction increases the risk of accidental enablement of unattended jobs under false assumptions about the skill's operating model.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: Module 10 similarly introduces automatic weekly generation that conflicts with the declared non-background nature of the skill. While not directly an exploit by itself, it undermines policy enforcement and safe review of operational capabilities.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: Module 23 explicitly instructs cron task creation for recurring briefings despite the skill-level claim of no background execution. This enables persistent autonomous behavior and could repeatedly process data or generate outputs without fresh user initiation.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Cron-based recurring briefing creation expands the skill from a reference framework into an automation agent. Background automation increases blast radius because mistakes, prompt injections, or data-quality issues can recur repeatedly without human review each run.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill instructs Python/code execution for factor computation and backtesting, but the manifest only declares data-analysis and reference-framework tools. Undeclared execution capability is dangerous because reviewers may not account for code-running behavior, dependency use, or expanded attack surface.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.