Security audit

News Fund Analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill is not destructive, but it needs review because a finance-advice skill bundles a much broader general web-search skill with weak scope boundaries.

Install only if you are comfortable with the agent sending fund, market, and possibly personal portfolio/risk-preference queries to external search engines and producing model-generated investment actions. Treat the output as research support, not professional financial advice, and avoid using the bundled generic search guidance for unrelated sensitive searches or unsafe search settings.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file documents a generic multi-search-engine web search capability, while the surrounding skill metadata describes a fund-news analysis and investment-advice skill. This mismatch is dangerous because it can mask the actual behavior and permissions of the skill, undermining user trust, reviewer validation, and policy enforcement; a broadly capable search tool could be invoked in ways not expected from a finance-focused analyzer.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file is materially inconsistent with the declared skill purpose: instead of fund/news analysis guidance, it provides a broad international search-engine playbook. This scope mismatch can expand the agent’s effective capabilities, weaken user and platform trust boundaries, and enable unintended data gathering or behavior outside the reviewed investment-analysis use case.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The skill is authored entirely in Chinese and does not offer a language-choice path, which can exclude users or cause misunderstanding if activated for users speaking another language. In a finance context, language mismatch is more sensitive because misunderstood risk disclosures, probability statements, or buy/sell guidance can lead to user harm.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The usage examples are broad natural-language phrases such as asking why a fund dropped or whether it can be bought now, which can overlap with ordinary financial conversation. This can cause unintended activation of the skill and route users into a prescriptive investment-analysis workflow, increasing the chance of inappropriate financial advice or unnecessary collection of portfolio/risk-preference data.

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: The visible instructional content and section headings are presented exclusively in Chinese, while the policy requires avoiding forced language or locale constraints unless the user is given a choice or the restriction is clearly justified. This can exclude users who do not read Chinese, and the file does not indicate that the language limitation is optional or region-specific.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The config explicitly assigns multiple search engines to the "cn" region and includes a China-specific Bing endpoint, but provides no natural-language indication that users can choose or opt into this locale behavior. Under the policy rule for language/locale constraints, hard-coded regional behavior without user choice can be a policy violation.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The document includes broad workflows for developer research, shopping, privacy tooling, general knowledge, and other unrelated domains, which exceeds what a fund analyzer should expose. In an agent setting, this increases attack surface by normalizing off-purpose actions and can be repurposed for uncontrolled browsing or sensitive-query assistance unrelated to the skill’s stated function.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The guide explicitly documents disabling DuckDuckGo safe search (`kp=-1`) without any warning, justification, or policy guardrails. For an agent-operated skill, this can lead to retrieval of explicit, harmful, or otherwise unsafe content during automated browsing, especially because the skill’s declared fund-analysis context does not require relaxed safety filtering.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The cached/deleted-page retrieval examples encourage accessing removed or cached content without discussing privacy, legal, or sensitivity concerns. While not inherently malicious, this can facilitate access to stale or intentionally removed information and is unnecessary for the skill’s stated fund-news analysis purpose.

Static analysis

No suspicious patterns detected.