Security audit

Treasury Scenarios

Security checks for vulnerabilities and agentic risk

Overview

This is a static Chinese-language treasury workflow reference skill that documents sensitive financial interfaces but does not ship code or execute transactions.

Install this only where users are authorized to view the treasury interface and workflow details. Treat the payment, payroll, transfer, account, and login-token material as documentation; any real banking integration should add separate role checks, approval flows, explicit confirmations, and audit controls outside this skill.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Vague Triggers

High

Confidence: 95% confidence
Finding: The manual fund transfer interface directly supports moving money between accounts, yet the manifest only describes it functionally and does not specify strict trigger boundaries, approval requirements, or prohibited use cases. In an agent setting, an underspecified transfer tool is especially dangerous because ambiguous prompts could be interpreted as authorization to initiate real fund movement, leading to fraud or unauthorized treasury actions.

Vague Triggers

High

Confidence: 97% confidence
Finding: This payroll scenario maps generic terms such as payroll, salary payment, and batch payment to a workflow that uploads a Base64 file and initiates bulk wage disbursement. Because payroll execution is a high-impact financial action, ambiguous triggers materially raise the risk of unintended invocation, accidental payment processing, or social-engineering-assisted misuse.

Vague Triggers

High

Confidence: 96% confidence
Finding: The supplier payment scenario uses broad payment-management language for creating payment applications and payment orders, including status tracking for real funds movement. In a treasury context, ambiguous routing can cause an assistant to move from discussion of invoices or approvals into actual payment initiation without sufficiently explicit user intent.

Vague Triggers

High

Confidence: 96% confidence
Finding: The fund collection/disbursement scenario includes generic transfer-related terms for manual internal allocation operations. Even though this is framed as intra-group treasury management, accidental invocation could still trigger unauthorized fund reallocation between accounts or entities, creating material financial and operational risk.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: All user-facing instructions, triggers, and examples are presented only in Chinese, which effectively imposes a language requirement. The file does not state that the skill is limited to a Chinese-speaking or region-specific audience, nor does it offer an opt-in or alternative language.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger conditions are broad phrases such as 'XXX 流程' and '如何实现 XXX', which are common in normal user conversations and can cause the skill to activate outside its intended scope. In this context, unintended activation can lead the assistant to inject treasury-system-specific guidance or internal interface references into unrelated requests, creating confusion and possible overexposure of business process details.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: This manifest exposes multiple high-risk financial operations such as payroll disbursement, single-payment creation, balance/detail queries, and passwordless login token retrieval, but the interface descriptions do not define when these actions are allowed, who may invoke them, or what approvals and context checks must exist. In an agent skill, vague activation scope increases the chance that a generic user prompt could trigger sensitive banking actions or data access without adequate policy gating.

Natural-Language Policy Violations

Medium

Confidence: 78% confidence
Finding: All scenario names, keywords, and descriptions are presented only in Chinese, with no indication that the skill is region-specific or that users can opt into another language. This can violate language or locale policy when the skill is intended for broader use but does not document a justified locale restriction.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The scenario defines broad business keywords like account management and balance inquiry without explicit activation boundaries, user-intent confirmation, or exclusion conditions. In an agentic system, loose routing terms can cause the skill to activate on general finance conversations and expose sensitive banking data or initiate downstream banking workflows unintentionally.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The month-end closed-loop scenario is described as an end-to-end workflow spanning planning, payment execution, querying, and reconciliation under broad lifecycle language. Bundling multiple sensitive steps under a general business description increases the chance that one user request could over-trigger a chain involving both analysis and payment-related actions.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: All natural-language labels and descriptions in the file are written in Chinese, and the manifest provides no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking environment. That can violate language/locale policy when a skill implicitly forces one language without user opt-in or documented regional justification.

Natural-Language Policy Violations

Low

Confidence: 89% confidence
Finding: The manifest description is written entirely in Chinese and presents the skill as a Chinese-language banking system capability, with no indication that users can choose another language or locale. Under the policy, language-specific constraints should be clearly justified or offered as an opt-in; this manifest provides neither.

Static analysis

No suspicious patterns detected.