胡田 OPC导师 即期本票

• Outcome: Review
• Latest audit: May 29, 2026, 5:08 PM
• Version:
  1.0.0

Overview

This is a non-executable financial review skill, but it includes under-scoped operational guidance for high-value and cross-border financial workflows that users should review carefully before relying on it.

Install only if you need a reference checklist for promissory-note fraud review, and do not rely on it to execute or approve transactions. Treat the SBLC, green-channel, and project-specific financing sections as unverified and require qualified legal, banking, and compliance review before any real financial action.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill is presented as an immediate-promissory-note anti-fraud/compliance guide, but it broadens into cross-border instruments and operational guidance. Scope drift is dangerous because users may rely on the skill for adjacent financing workflows that were not declared, reviewed, or constrained, creating a pathway for unsafe or unauthorized financial-process assistance.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This section includes project-specific financing workflow instructions, including execution sequencing and handling guidance, which goes beyond fraud detection into operational transaction support. In a financial-risk skill, such hidden expansion is dangerous because it can normalize or facilitate real-world deal structuring without appropriate legal, compliance, or institutional controls.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The SBLC repatriation and 'green channel' guidance is highly specific operational content unrelated to the declared anti-fraud purpose and could be used to legitimize or facilitate sensitive cross-border financial movements. Even if intended as background context, embedding such instructions in a broadly framed skill increases the risk of misuse, policy evasion, or inappropriate reliance on unverified financing procedures.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The decision flowchart conflicts with the written decision table and appears to route low-risk cases toward termination instead of approval/conditional approval. In a fraud-prevention and transaction-review skill, contradictory decision logic can cause systematic misclassification, operator confusion, and unsafe or incorrect handling of transactions, especially if users rely on the visual flowchart for fast decisions.

VirusTotal

65/65 vendors flagged this skill as clean.