Security audit

RiskOfficer

Security checks across malware telemetry and agentic risk

Overview

RiskOfficer is a disclosed financial analytics skill that uses a RiskOfficer API token to manage virtual portfolios and broker-synced data, with no evidence of hidden code or malicious behavior.

Install only if you trust RiskOfficer with your portfolio and broker-synced financial data. Prefer setting RISK_OFFICER_TOKEN as a session environment variable, rotate or revoke the token when done, and carefully review confirmations before deleting portfolios, applying optimizations, syncing live broker data, or disconnecting broker integrations.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Intent-Code Divergence

Low

Confidence: 81% confidence
Finding: The README states the skill contains 'only Markdown' and 'no executables or scripts', yet it instructs users to run shell commands and modify persistent configuration with an API token. Even if the repository itself has no binary payloads, this wording can create a false sense of safety and reduce scrutiny around installation and credential handling.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The scope disclaimer says 'analysis and research only; no real broker orders,' but the documented capabilities still include state-changing actions such as broker connect/sync/disconnect and portfolio create/update/delete. That mismatch can mislead users and downstream agents into underestimating the operational impact of invoking the skill, especially where linked brokers or production portfolios are involved.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The feature list advertises destructive and account-affecting operations such as edit/delete portfolios and broker connect/refresh/disconnect without any warning about confirmation, reversibility, or user consent. In an agentic context, presenting these operations as ordinary commands increases the chance of accidental execution against real user data or integrations.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The usage examples include 'Delete my test portfolio' and 'Disconnect Tinkoff broker' with no cautionary note. For LLM-driven tools, examples strongly shape behavior; showing destructive commands without warnings or confirmations can normalize unsafe execution and lead to unintended state changes.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The methodology explicitly allows applying a portfolio when the pre-trade check returns a warning, including cases where important controls such as VaR or sector concentration could not be verified because data was unavailable. In a portfolio risk-management skill, treating unverifiable controls as proceedable creates a fail-open path that can bypass intended risk gates and lead to execution of trades with unknown risk characteristics.

External Transmission

Medium

Category: Data Exfiltration
Content: -H "Authorization: Bearer ${RISK_OFFICER_TOKEN}" # Search by Russian name curl -s "https://api.riskofficer.tech/api/v1/tickers/search?q=%D0%93%D0%B0%D0%B7%D0%BF%D1%80%D0%BE%D0%BC&locale=ru&limit=5" \ -H "Authorization: Bearer ${RISK_OFFICER_TOKEN}" # Get current price for a ticker
Confidence: 93% confidence
Finding: https://api.riskofficer.tech/

External Transmission

Medium

Category: Data Exfiltration
Content: -H "Authorization: Bearer ${RISK_OFFICER_TOKEN}" # Get current price for a ticker curl -s "https://api.riskofficer.tech/api/v1/tickers/search?q=AAPL&include_prices=true" \ -H "Authorization: Bearer ${RISK_OFFICER_TOKEN}" # Get popular tickers (no query param)
Confidence: 93% confidence
Finding: https://api.riskofficer.tech/

External Transmission

Medium

Category: Data Exfiltration
Content: -H "Authorization: Bearer ${RISK_OFFICER_TOKEN}" # Get popular tickers (no query param) curl -s "https://api.riskofficer.tech/api/v1/tickers/search?limit=10&include_prices=true" \ -H "Authorization: Bearer ${RISK_OFFICER_TOKEN}" # Filter by exchange
Confidence: 92% confidence
Finding: https://api.riskofficer.tech/

Session Persistence

Medium

Category: Rogue Agent
Content: Manage investment portfolios, calculate risk metrics (VaR, Monte Carlo, Stress Tests), and optimize allocations using Risk Parity, Calmar, or Black-Litterman — all through natural language chat. Includes pre-trade risk checks with sector concentration limits and cross-portfolio correlation analysis. **Required:** One env var — `RISK_OFFICER_TOKEN` (create in RiskOfficer app → Settings → API Keys). **Source:** [github.com/mib424242/riskofficer-openclaw-skill](https://github.com/mib424242/riskofficer-openclaw-skill) · [riskofficer.tech](https://riskofficer.tech) ## Features
Confidence: 72% confidence
Finding: create in RiskOfficer app → Settings → API Keys). **Source:** [github.com/mib424242/riskofficer-openclaw-skill](https://github.com/mib424242/riskofficer-openclaw-skill) · [riskofficer.tech](https://

Session Persistence

Medium

Category: Rogue Agent
Content: Connects to the RiskOfficer API to manage investment portfolios and calculate financial risk metrics. **Required:** One environment variable — `RISK_OFFICER_TOKEN` (create in RiskOfficer app → Settings → API Keys). No other env vars or binaries are required. **Source:** Official skill repository: [github.com/mib424242/riskofficer-openclaw-skill](https://github.com/mib424242/riskofficer-openclaw-skill). Product: [riskofficer.tech](https://riskofficer.tech). The token is issued only by the RiskOfficer app; this skill does not collect or store credentials.
Confidence: 84% confidence
Finding: create in RiskOfficer app → Settings → API Keys). No other env vars or binaries are required. **Source:** Official skill repository: [github.com/mib424242/riskofficer-openclaw-skill](https://github.c

Unsafe Defaults

Medium

Category: Tool Misuse
Content: - `sandbox=false` for live connection, `sandbox=true` for sandbox - Removes the connection and its saved API key; portfolio snapshot **history is preserved** - To also delete snapshot history, first use `DELETE /portfolio/broker/{broker}?sandbox=false` - **ALWAYS confirm before disconnecting** — reconnection requires the mobile app **Difference between the two delete endpoints:**
Confidence: 81% confidence
Finding: sandbox=false

Unsafe Defaults

Medium

Category: Tool Misuse
Content: ### User wants to disconnect a broker "Disconnect Tinkoff" / "Отключи Тинькофф" → Confirm: "This will remove the Tinkoff connection. Portfolio history will be kept. Continue?" → On confirmation: `DELETE /brokers/connections/tinkoff?sandbox=false` → Inform that reconnection requires the mobile app ### User wants Black-Litterman optimization
Confidence: 82% confidence
Finding: sandbox=false

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.