Security audit

Ai Company Cfo 2.0.0

Security checks for vulnerabilities and agentic risk

Overview

This finance skill is not malicious, but it needs Review because it combines broad file, network, memory, and inter-agent powers with automatic finance-data routing that is not tightly scoped.

Install only in a workspace intended for this CFO persona, and grant elevated permissions only if you are comfortable with financial context being read, written, persisted, and routed to other agents. Prefer read-only or explicit-confirmation operation for API calls, inter-agent messages, financial record changes, and memory promotion.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: AGENTS.md:11
Finding: Session Identity and Goal Hijacking Through Automatically Loaded Persona Instructions
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: AGENTS.md:14
Finding: Automatically Reloaded Writable Memory Can Persist Untrusted Agent Context Across Sessions
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:58
Finding: Excessive Filesystem, Network, and Inter-Agent Permissions Enable Unnecessary Data Access and Routing
Content: View full analysis
", "current_value": "<实测值>", "threshold": "<阈值>", "duration": "<持续时间>", "fair_vars": { "LEF": "<低|中|高|极高>", "LM": "<低|中|高|极高>", "risk_exposure": "<计算值>" }, "suggested_cro_risk_level": "", "route": "CFO→HQ→CRO" } ``` ``` ### Technical Analysis The package is composed of Markdown and metadata and contains no implementation that technically requires unrestricted workspace read/write access, general API network access, subagent creation, and arbitrary inter-session messaging. Nevertheless, the manifest requests all of these capabilities. The `sessions_send` and `subagents` capabilities expand the trust boundary beyond the current conversation. Combined with general file access and network API access, they could allow sensitive financial or personal workspace data to be read, modified, or propagated to other agents. The routing instructions state that alerts are sent automatically when thresholds are met. Although routing through HQ provides an organizational path, it is not a substitute for authorization, recipient validation, data minimization, or user consent. The structured alert includes measured financial values, duration, thresholds, and calculated risk exposure. No evidence shows ...[truncated 1673 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire skill file is written as mandatory operating instructions in Chinese, including behavioral directives like '数字说话。表格呈现。零废话。' There is no indication that language choice is optional or limited to a justified region-specific context, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language instructions and checklist are entirely in Chinese, which can impose a language constraint on users or operators without any opt-in or justification. Under the language/locale policy, skills should not force a specific language unless they explicitly offer choice or document a justified regional scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown profile is written entirely in Chinese and defines the role's communication style, but it does not indicate that language selection is optional or limited to a China-specific use case. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list contains broad, generic finance terms such as CFO, ROI, cash flow, budget allocation, and compliance, which can cause the skill to activate in ordinary financial discussions rather than only when explicitly requested. Because this skill also has write and network permissions plus MCP messaging/subagent capabilities, accidental invocation could expose sensitive financial context or cause unintended downstream actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill requests file write and network/API access, along with MCP capabilities to send sessions and invoke subagents, but does not present any user-facing warning, consent flow, or data-handling constraints. In a finance-oriented skill that may process budgets, transactions, cash flow, and audit data, these permissions materially increase the risk of silent exfiltration, modification of records, or autonomous propagation of sensitive information.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire skill specification is written in Chinese and defines the agent persona and response style solely in that language, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The log documents use of npx clawhub publish without a pinned package version, which can fetch and execute whatever package version is current at invocation time. If the upstream package is compromised, typosquatted, or a malicious version is published, this creates a software supply chain execution risk on the operator workstation or CI environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs recording heartbeat status in the memory/ directory, which implies persistent storage, but it provides no user-facing disclosure, consent mechanism, or retention guidance. Even though the stored content appears operational rather than highly sensitive, silent persistence can create privacy, governance, and data-minimization issues, especially in finance-related workflows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Natural-language policy review applies to all file types. The description is presented in Chinese and the rest of the skill content is also Chinese-centric, but there is no explicit opt-in, multilingual option, or documented reason that the skill must operate in that language/locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file is entirely written as a CFO tool note and speech template in Chinese, including the title and output template. This suggests the skill may enforce a specific language/locale for responses without any opt-in, alternative language option, or documented regional justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.