Security audit

段永平投资判断 · 价值投资方法论

Security checks across malware telemetry and agentic risk

Overview

This is a text-only investment-methodology skill with clear disclaimers and no executable, persistent, or data-access behavior.

Before installing, understand that this skill may activate for stock or business decision questions and can sound evaluative. Use it as a structured thinking aid, not as personalized financial advice, and verify facts independently before making investment decisions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger example is broad enough to match ordinary investing queries like whether a stock or investment is worth buying, which can cause the skill to activate in high-stakes financial decision contexts without clear narrowing conditions. In practice, this increases the chance the skill will be invoked when users are seeking actionable advice, making the framework functionally similar to investment guidance despite the disclaimer.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger condition '用户在做投资/创业/商业决策，想套"本分、做对的事情"的框架' is broader than the skill's stated investing purpose and can capture generic business or decision-making requests. That can cause the agent to invoke this investment-oriented methodology in unrelated contexts, producing inappropriate or overconfident guidance and bypassing more suitable domain-specific handling.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.