Security audit

金融营销合规助手

Security checks across malware telemetry and agentic risk

Overview

This is a coherent local financial marketing compliance helper, with broad tool permissions and triggers that users should scope carefully.

Install only if you want an agent to review or draft financial marketing compliance materials. Treat outputs as advisory rather than legal advice, verify current regulations with a qualified reviewer, and avoid granting broad Write access unless you specifically need saved reports.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The activation description is broad enough to trigger on generic finance or compliance-related conversations, which can cause the skill to engage outside its intended scope. In a compliance skill with Bash/Read/Write/Exec available, overbroad invocation increases the chance of unnecessary file access, unintended workflow execution, or user confusion about authoritative legal/compliance advice.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: A generic trigger phrase at this line makes invocation criteria insufficiently specific, so ordinary user requests may unintentionally activate this skill. Because the skill is positioned as a core compliance assistant and has powerful tools enabled, accidental activation could lead to overcollection of content, inappropriate automated judgment, or execution paths not warranted by the user's request.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.