Vague Triggers
High
- Confidence
- 95% confidence
- Finding
- 触发词设置为“财务、分析、报表、预算、经营分析”等常见词，极易在普通对话中被无意匹配，导致技能在不相关场景下被激活。虽然这更偏向配置缺陷而非直接攻击载体，但会扩大该技能接触用户输入和业务上下文的范围，增加误用、越权介入或敏感信息被错误引入当前会话的风险。
Security audit
财务分析师
Security checks across malware telemetry and agentic risk
Overview
This is a finance-analysis prompt skill with no executable code, but it should be used carefully with sensitive company data.
Install only if you want a Chinese-language finance analyst prompt. Use authorized, task-specific, preferably redacted financial exports. Do not provide ERP, HR, database, session, cookie, or credential access. If your agent platform has long-term memory, disable or restrict it for confidential financial, customer, employee, forecast, or management information.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Ssd 3
Medium
- Confidence
- 97% confidence
- Finding
- 技能明确要求“记住并积累”业务与财务结合点、预测偏差模式、管理层关注点、数据质量问题、历史模型复盘等跨交互信息，这会鼓励持久化或跨会话保留组织级和用户提供的信息。对于财务分析场景，这些内容高度可能包含经营数据、管理偏好、预测误差、内部流程缺陷等敏感商业信息，一旦被不当保留、复用或泄露，影响较大。
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 93% confidence
- Finding
- 触发词“财务”过于宽泛，是大量正常业务对话中的常见词，容易导致技能误触发。单独看影响较低，但在财务技能上下文中，误触发后更可能让系统把普通交流导入涉及预算、利润、现金流等敏感分析流程。
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 95% confidence
- Finding
- “分析”是极高频通用词，几乎可出现在任何讨论中，因此自动触发该技能的误报概率很高。这会让技能在与财务无关的上下文中被调用，扩大无关数据暴露给技能指令集的机会。
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 89% confidence
- Finding
- “报表”虽然比“分析”稍具体，但仍是企业环境中的常见通用词，可能对应销售、运营、人事等多种非财务报表，存在误触发风险。该技能面向财务分析，误触发后可能错误引导用户提供更多内部经营数据。
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 90% confidence
- Finding
- “预算”在企业场景中也很常见，可能出现在项目、市场、人力等多类讨论中，触发范围过宽。由于该技能会处理预测、现金流、投资测算等敏感内容，误触发会增加将内部财务信息带入技能处理链路的可能。
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.