Portfolio Monitor | 投资组合监控

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:38 AM UTC
• Version: 1.0.0

Overview

This is a coherent portfolio-monitoring report skill, but it handles sensitive investment holdings and uses external financial/news sources.

Install only if you are comfortable providing portfolio holdings for analysis. Confirm before sharing sensitive holdings, be aware that ticker-related queries may go to financial/news providers, and treat generated buy/sell suggestions as informational rather than automatic trading instructions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:136

Finding

Hard-Coded Third-Party Persona and Attribution in Generated Reports

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 136–138 and line 162
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Low

Complete vulnerable excerpt translated into English:

markdown

Investment Partner J's advice:
Stay disciplined and do not be influenced by short-term fluctuations.

Built for LEE's investment partner J | Continuous monitoring and timely alerts

Technical Analysis

The weekly-report template requires the agent to insert a fixed “Investment Partner J” persona into user-facing reports. The document also contains a hard-coded footer associating the output with “LEE” and “J.”

These identity and attribution instructions are not necessary for portfolio calculations, market monitoring, or risk analysis. When the skill is loaded and its template is followed, they alter the identity and presentation of the agent's response by making it appear that an unrelated third party authored, endorsed, or commissioned the report.

This is a limited form of instruction hijacking because the effect is confined to generated report content. The audited file does not instruct the agent to bypass safety controls, disclose secrets, execute code, modify persistent state, or obtain additional system privileges.

Attack Path

1. The portfolio-monitoring skill is loaded into an agent session.
2. A user requests a weekly portfolio report.
3. The agent follows the mandatory report template in SKILL.md.
4. The generated report includes advice attributed to “Investment Partner J.”
5. The report may also include the hard-coded “LEE” and “J” attribution.
6. The user receives content that can misleadingly appear authored or endorsed by those third parties.

Impact Assessment

The issue can affect the integrity and provenance of user-facing portfolio reports. It may create misleading authorship, endorsement, or personalization claims and contaminate otherwise neutral financ ...[truncated 297 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the fixed “Investment Partner J” advice block from the weekly-report template.
2. Remove the footer that associates generated output with “LEE” and “J.”
3. Use neutral labels such as “Portfolio Monitoring Summary” for standard reports.
4. If custom branding is a legitimate feature, obtain explicit user consent and accept the desired author or organization name as user-controlled configuration.
5. Clearly distinguish automated analysis from advice authored or endorsed by a named person.
6. Add a template review rule that rejects fixed third-party identities, endorsements, and personalized attribution unless they are essential to the declared purpose and explicitly authorized by the user.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to match ordinary investing questions, which can cause the skill to activate when the user did not explicitly intend portfolio analysis. In this context, unintended activation is risky because the skill handles sensitive financial holdings and may prompt collection, analysis, or external fetching tied to private investment data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs collection of portfolio holdings and retrieval of market, filing, and news data from external sources without any privacy warning, consent step, or data-minimization guidance. Because portfolio composition is highly sensitive financial information, sending or correlating it with third-party APIs or scraping workflows can expose a user's investments, trading interests, and risk profile.

Content

No source excerpt is available for this finding.