Investment Risk Scanner (Buffett + Porter Framework)

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:43 PM UTC
• Version:
  2.1.0

Overview

This is an instruction-only investment risk checklist; its main issue is that it may give broad buy/watch/avoid-style analysis, not that it accesses accounts or runs hidden code.

Install this only if you want a structured investment-risk screening framework. Be cautious with broad triggers like “valuation” or “can I buy this stock,” verify market data independently, and do not rely on the skill as professional financial advice or as authority to trade.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrases are broad enough to match many ordinary investment questions, which can cause the skill to activate outside the user's intended context. In a finance-oriented skill that gives legitimacy/risk judgments, accidental invocation can lead to overconfident screening output being applied where nuanced or regulated financial guidance would be more appropriate.

VirusTotal

65/65 vendors flagged this skill as clean.