openInvest

• Outcome: Review
• Latest audit: Jul 17, 2026 · 10:15 PM UTC
• Version: 0.20.1

Overview

The skill is a coherent investment assistant, but it should be reviewed because it can handle private financial data, mutate portfolio records, collect credentials, and persist investment histories without enough consent and secret-handling guidance.

Install only if you are comfortable letting this skill and its openinvest backend access your portfolio records, wealth context, local investment history, and optional LLM/email or remote-hub credentials. Prefer a dedicated data directory, avoid pasting secrets into chat, review what is stored under INVEST_HOME and memory/.committee, and confirm before any buy/sell/deposit/withdraw, trade-status, config, or remote-hub write operation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill repeatedly instructs the agent to execute shell commands such as `run.sh doctor`, `run.sh status`, `curl /api/user`, and `run.sh run_committee`, but there is no declared permissions boundary in the skill metadata. This creates a capability mismatch where an agent may be induced to run local commands or contact services without an explicit, reviewable permission model, increasing the chance of unintended command execution.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The document explicitly says the CLI subcommand names are a closed set, then later instructs agents to prefer native `track_asset` / `untrack_asset` / `set_allocations` equivalents that are not present in that closed-set table. In an agentic tool-using context, this inconsistency can induce hallucinated tool calls, fallback to undocumented paths, or unsafe error-recovery behavior, especially when the surrounding text pressures the agent to take portfolio-modifying actions.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger phrases are broad and overlap with normal conversation, including generic requests like 'analyze X', 'show portfolio', and 'how is my P&L'. Overbroad activation can cause the skill to run in contexts the user did not intend, potentially leading to unnecessary shell execution, portfolio access, remote API calls, or token-consuming committee runs.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The documentation states that committee output is written to `memory/.committee/<date>/TSLA.md` for history, but it does not warn the user that asset analysis requests will create persistent local records. In an investment skill, those records can reveal sensitive financial interests, trading intent, or research history to other local users, backups, or synced folders, so the omission is a real but low-severity privacy issue.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The protocol is designed to activate from ordinary conversational phrases like 'analyze X' or 'should I buy/sell X', which are broad enough to match routine discussion rather than an explicit request to invoke this powerful skill flow. In this investment context, accidental triggering can cause unintended execution of shell commands, portfolio analysis, or persistence of decision artifacts, especially because the protocol proceeds into operational stages once invoked.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This protocol instructs the agent to persist full committee transcripts, including portfolio summaries, prior insights, risk analysis, and CIO output, into local disk storage without requiring an explicit user consent or presenting a user-facing warning at the point of collection. In an investment skill, these records can contain sensitive financial data and behavioral history, creating a privacy and data-retention risk if the host is shared, compromised, or the user does not expect durable storage.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The onboarding flow explicitly instructs the agent to collect a DeepSeek API key and Gmail App Password and pipe them via stdin into initialization, but it does not require a clear security warning, consent checkpoint, masking guidance, or safer secret-entry path. This creates a real risk of exposing credentials in chat transcripts, logs, shell history, agent telemetry, or to the model itself, especially because Gmail app passwords grant mail-sending access and API keys can be abused for account usage.

Missing User Warnings

Medium

• Confidence: 77% confidence
• Finding: The documentation exposes `GET /api/user` and `PUT /api/user/wealth_context` for highly sensitive financial and personal context, but provides no user-facing consent, minimization, or privacy warning. In a daily-use investment skill, that omission increases the chance an agent will retrieve or store intimate financial/lifestyle data by default, expanding unnecessary data exposure.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The documented trade-status flow states that marking a trade as executed automatically updates portfolio records, yet it lacks an explicit warning that this is a state-changing operation with financial record consequences. In an autonomous or semi-autonomous agent setting, that can cause accidental ledger mutation if the agent interprets ambiguous user language as authorization to execute the writeback.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The phrase "run a deep analysis / 跑深度分析" is ambiguous and can cause an orchestrating agent to invoke the expensive or broad-scope daily report path when the user may only want analysis of a single asset. In this skill, that matters because the document itself warns that `jobs.daily_report` runs every asset at once and burns API credits, so loose trigger wording can lead to unintended cost, over-execution, and surprise actions.

Credential Access

High

• Category: Privilege Escalation

Content

| Command | Remote-mode behavior |
|------|--------------|
| `doctor` | Returns **hub-perspective** checks + an extra `remote` section (api_base / auth mode / connectivity) |
| `init` | **Disabled** (data lives on the hub; connecting to the hub only needs the two .env lines above). Error includes a hint |
| `live_prices` / `correlate` | Still run **locally** (pure yfinance, touches no data) |
| `run_committee` | Runs on the **hub** (DeepSeek key is on the hub); the CLI polls automatically until done; same-day cache uses the hub's date semantics |
| `prepare/save_committee` | Via hub RPC — the Coordinator protocol (spawn 4 subagents) is **completely unchanged** |

• Confidence: 92% confidence
• Finding: The skill directs use of sensitive credentials in `.env`, including `INVEST_API_TOKEN`, `CF_ACCESS_CLIENT_ID`, `CF_ACCESS_CLIENT_SECRET`, and API keys, and encourages authenticated remote access via headers. In agent environments, instructions that normalize reading or using local credential material can lead to credential exposure, misuse against remote hubs, or unauthorized access if prompts or tool traces are logged or if the agent overreaches in gathering configuration.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.