Security audit

Fund Signal Monitor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed fund-signal monitoring guide with expected watchlist, scheduling, data-source, and push-notification behavior, but users should review privacy settings before enabling alerts.

Before installing or enabling monitoring, confirm which funds are saved in the watchlist, which external data sources and notification channels are used, and how to remove monitoring entries. Treat pushed alerts as sensitive because they can reveal investment interests, and rely on the included investment-risk disclaimer rather than treating alerts as financial advice.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: This markdown file presents the skill assessment entirely in Chinese, starting from the title, and does not indicate that the language is optional or region-specific. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Intent-Code Divergence

Medium

Confidence: 82% confidence
Finding: The security assessment states '数据只读不写（除配置外）' at L285, but elsewhere the document describes user configuration persistence (L084, L350), encrypted storage of monitoring lists (L304, L356), and a data deletion mechanism (L305). Those are write-side behaviors beyond a purely read-only characterization, so the documentation internally contradicts itself about whether the skill has stateful data modification side effects.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill advertises very broad activation conditions around 'monitoring fund signals' and related events without clear limits on when it should trigger or when user confirmation is required. In an agent ecosystem, this can cause overbroad invocation, leading to unintended monitoring behavior, unnecessary collection or processing of user investment preferences, and accidental handoff to linked skills.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill describes saving a watchlist, starting scheduled tasks, querying external data sources, and pushing notifications, but does not clearly disclose that user-selected funds and monitoring preferences will be stored and shared with third-party services/APIs. This creates a privacy and consent gap: users may unknowingly enable persistent tracking and external data access on their behalf.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill output advertises Feishu/WeChat push delivery for fund-monitoring alerts without any notice that user data, fund interests, and notification metadata may be transmitted to external messaging platforms. In a finance-related monitoring context, those alerts can reveal sensitive investment preferences or activity patterns, so omission of consent/privacy disclosure creates a real privacy and data-handling risk even if no explicit exploit payload is present.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The prompts, headings, and expected behavior are entirely written in Chinese, which indicates the skill is designed around a single language experience. The file does not offer an opt-in language choice or explain that the skill is intentionally restricted to a Chinese-speaking or region-specific context.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: Natural-language descriptions, examples, warnings, and user interaction phrases are all presented exclusively in Chinese, including quoted user replies such as '分析 005827'. Under the stated policy, forcing a specific language without user opt-in can be a language/locale policy issue unless the locale restriction is explicitly documented and justified.

Natural-Language Policy Violations

Low

Confidence: 89% confidence
Finding: The manifest description forces a specific language/locale presentation, which can be a natural-language policy concern when no user choice or opt-in is offered. There is no indication elsewhere in the file that the skill supports multiple languages or is explicitly limited to a Chinese-only audience.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The file is written entirely in Chinese, including headings and operational notes, with no indication that the skill is region-specific or that users may choose another language. Under the language/locale policy, a forced locale without opt-in or justification is a natural-language policy concern.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: This markdown file contains user-facing natural-language content exclusively in Chinese, but does not mention that the language is fixed by design or optional. Under the policy rule for language/locale, forcing a specific language without opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: This markdown file contains user-facing natural language exclusively in Chinese, including the title, section headings, conclusions, and recommendations. Under the policy rule for language/locale constraints, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.

Static analysis

No suspicious patterns detected.