Financial Analysis Toolkit

• Outcome: Pass
• Latest audit: Jun 19, 2026 at 4:06 PM UTC
• Version:
  1.0.0

Overview

This skill is a finance-analysis helper that fetches public market data and does not show hidden persistence, credential access, or account-changing behavior.

Install only if you are comfortable with finance-related prompts being used for third-party data lookups. Treat outputs as analytical assistance, not financial advice, and verify important investment decisions with authoritative sources.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The activation guidance is broad: phrases like '查一下 XX 股票', '分析 XX 行业', and '大盘怎么样' are common finance queries and provide little boundary on when this skill should activate. That increases the chance of unintended invocation, causing the agent to use this toolkit in contexts where the user did not explicitly request this workflow or where a narrower, safer, or more appropriate skill should have been selected.

VirusTotal

53/53 vendors flagged this skill as clean.