Mutual Fund Evaluator

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:35 PM UTC
• Version:
  1.0.0

Overview

This skill is a hosted mutual fund evaluation API guide that asks for financial profile details, with no evidence of hidden execution or account-changing behavior.

Before sending real financial details, review ToolWeb's privacy and retention practices and use approximate or redacted portfolio and tax information where possible. Treat the output as informational analysis, not regulated financial advice.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill solicits detailed personal financial profiling data such as age, portfolio status, risk tolerance, tax sensitivity, and investment goals, and states that it uses web search in its analysis, but it does not warn users that this sensitive information may be transmitted to external services. In a financial context, lack of disclosure can lead to unintended exposure of personal and inferred financial data, creating privacy, compliance, and user-consent risks.

VirusTotal

66/66 vendors flagged this skill as clean.