决策清单

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:24 PM UTC
• Version:
  2.0.0

Overview

This is a plain-text investment decision checklist skill with no code execution, credentials, persistence, or data transfer, though users should treat its outputs as analysis prompts rather than financial advice.

Install only if you want an investment-analysis checklist to activate on investment-related prompts. Review its conclusions carefully: it may output ratings, recommended/not-recommended labels, position sizing, and buy-strategy suggestions, but it cannot verify current market facts and should not replace independent research or qualified financial advice.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrases are broad enough to match ordinary investment discussion, which can cause the skill to activate unintentionally in contexts where the user did not explicitly request this checklist workflow. In an agent setting, over-broad activation can lead to prompt hijacking of normal conversation flow, inappropriate financial-style recommendations, or accidental processing of sensitive user content under the wrong skill.

VirusTotal

65/65 vendors flagged this skill as clean.