Investment Analysis Workflow

Security checks across malware telemetry and agentic risk

Overview

This is a plain investment-analysis workflow skill that reads and updates investment notes, with no executable code or hidden network/credential behavior found.

Install this only if you want an agent to help maintain investment research files. Before allowing edits, confirm the request is about the intended investment/ directory or a specific security or industry, and review changes to summary stock-pool files because they may affect future investment analysis.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger list includes broad everyday phrases such as “工作流”, “追加分析”, and “合并报告”, which can cause the skill to activate in contexts unrelated to investment analysis. In an agentic environment, over-broad invocation increases the chance that the workflow will read or modify investment files when the user intended a general discussion, creating scope confusion and unintended file operations.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal