T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:35- Finding
Mutable External Analysis Content Can Manipulate Agent Trading Decisions
- Content
View full analysis
- Remediation
View remediation
Security audit
Portfolio Optimizer
Security checks for vulnerabilities and agentic risk
Overview
This skill is clearly for virtual portfolio trading, but it fetches mutable external analysis and can execute trades and overwrite strategy state without a required confirmation step.
Review this skill carefully before installing. It is intended for virtual trading, not real-money trading, but it can still change the connected virtual portfolio and write persistent strategy state. Use it only if you trust the external analysis repository, are comfortable with unpinned git updates, and add a confirmation or dry-run requirement before any orders or state overwrites.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are very broad (e.g. 'optimize portfolio', 'rebalance', 'execute investment strategy') and can activate a skill that performs buying and selling with little contextual disambiguation. In a trading context, overbroad activation is dangerous because ordinary planning or discussion requests may unintentionally trigger automated order placement.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs the agent to run
git pullorgit cloneagainst an external repository to obtain analysis data. Allowing a trading skill to fetch and trust remote content at execution time expands its authority beyond portfolio optimization, introduces supply-chain risk, and could expose credentials or ingest attacker-controlled instructions/data that influence trades or subsequent actions.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill directs destructive actions—placing sell/buy orders and overwriting
strategy_state.md—without any mandatory user-facing warning, dry-run default, or confirmation gate. Even in a virtual-trading environment, this can cause unintended transactions, irreversible state changes, and persistence of attacker-influenced strategy memory that affects future ticks.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file documents and encourages use of
place_orderto execute market or limit buy/sell orders, but it does not require an explicit user confirmation or prominently warn that this action causes real asset trades in the connected trading environment. In the context of a portfolio-optimization skill whose purpose is to trigger buy/sell/rebalance actions from natural-language requests, this omission increases the chance of unintended or overly broad autonomous trading, causing direct financial loss.- Content
Static analysis
No suspicious patterns detected.