Security audit

Banker Memo Md

Security checks for vulnerabilities and agentic risk

Overview

This skill is a focused Chinese banker-memo generator that reads a chosen raw-data folder and writes two report files, with manageable prompt-injection and path-scope caveats.

Install/use this only in a scoped project workspace. Provide trusted raw-data JSON snapshots, avoid adversarial filenames or path values, choose a dedicated output directory, and review the generated financial memo before relying on it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

Location: scripts/build_md_prompt.py:17
Finding: Untrusted Input Is Directly Interpolated into Privileged Agent Instructions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill instructs the agent to read from a caller-supplied raw-data directory and enumerate JSON inputs, but it does not declare an explicit tool/permission scope. In an agentic environment, missing scope boundaries can let the skill operate with broader file-read access than intended, increasing the chance of unintended data exposure if the path variables are manipulated or the runtime grants ambient filesystem access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The framework mandates substantial Chinese-language output elements, including section content and terminology such as 300-500 字, 授信 / 投资建议, and 具体授信建议, but the skill does not state that language is configurable or user-selected. This can violate language/locale policy when a skill implicitly requires a specific language without explicit opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions switch entirely into Chinese and direct the model to act as a PRC investment-banking analyst producing a Chinese memo, which effectively fixes the language/locale of the skill output. The file does not offer a user opt-in or alternative language choice, and no explicit policy justification for enforcing Chinese is stated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file explicitly states that the skill writes analysis.md and data-provenance.md into {out_dir}/. Because this is a file-modifying behavior, the skill description should include a clear user warning or disclosure about overwriting or creating files in the destination directory.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.