Security audit

Financial Research

Security checks for vulnerabilities and agentic risk

Overview

This finance-report skill is coherent, but it can automatically install unverified AnyGen tooling and workflows while routing financial data to a third-party service.

Install only if you trust AnyGen with the financial material you provide and are comfortable with its CLI and workflow installer changing the agent environment. Prefer a pinned/audited CLI version, review the installed workflow before use, and avoid sending confidential portfolio, company, or client data unless your AnyGen account and policies allow it.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:10
Finding: Unpinned Third-Party CLI Dependency
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:40
Finding: Unverified Remote Skill Installation with Automatic Confirmation
Content: View full analysis
-y ``` ``` ### Technical Analysis The fallback procedure directs the agent to install external skill content through the AnyGen CLI using `-y`, which suppresses an interactive confirmation step. The command does not identify a pinned workflow version, immutable source, checksum, or trusted signature. Because the remotely resolved skill can change after this repository has been reviewed, its effective instructions or executable components are outside the audited project. Loading such content without inspection introduces both remote payload and supply-chain exposure. ### Attack Path 1. The `anygen-workflow-generate` skill is absent from the local environment. 2. The fallback instruction triggers `anygen skill install` with automatic confirmation. 3. The CLI resolves and downloads the skill from its configured remote source. 4. An attacker-controlled or compromised source supplies modified skill instructions or executable components. 5. The agent loads or follows the installed workflow. 6. The remote content can influence agent actions and, if it contains or invokes executable components, operate with the agent process's available permissions. Exploitation depends on compromise or malicious control of the remote distribution source, the CLI's resolution path, or the distributed workflow artifact. ### Impact Assessment A malicious installed skill could alter subsequent agent behavior, cause unintended tool calls, expose data accessible to the agent, or invoke executable content. The maximum scope is determined by the agent's filesystem, network, cre ...[truncated 157 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation text is very broad and instructs the agent to use this skill for nearly any financial-analysis-related request, including generic terms like stock research, portfolio analysis, and investor memos. Overbroad triggering can cause the agent to invoke an external CLI and send sensitive user prompts or financial data to a third-party service when a narrower or local response would have been sufficient.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The manifest mixes English and Chinese trigger phrases as activation cues, but does not explain language-selection behavior, offer user opt-in, or justify a locale-specific policy. This can create a language/locale policy concern because the skill appears to encode language-specific behavior without documenting choice or constraints.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.