fund-cio-copilot

• Outcome: Review
• Latest audit: Sep 5, 2026 · 5:26 AM UTC
• Version: 2.6.2

Overview

The skill is not malware, but it should be reviewed because it can automatically retain sensitive investment records and create external Tencent Docs.

Install only in a workspace intended for confidential investment records. Before use, confirm who can access local workspace files and Tencent Docs, whether automatic capture is acceptable for rejected deals and portfolio reviews, and how retained mandate, decision, outcome, learning, and radar benchmark files will be deleted or protected.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The skill draws an important distinction between decision memory and radar intelligence memory, but the Memory Policy text is inconsistent: it says Radar does not write to Decision Memory while also permitting automatic capture of Radar benchmark cases into local memory files. This ambiguity can cause operators or downstream agents to persist sensitive intelligence unexpectedly, undermining data-governance expectations and increasing the risk of retention of information that users assumed would not be stored.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The skill repeatedly frames itself as 'non-executing' and a decision-only copilot, but later authorizes scheduled autonomous generation, local file writes, Tencent Docs creation, and capture workflows. That mismatch is dangerous because users may grant or invoke the skill under a false assumption of passivity, while it actually performs state-changing actions that can persist or disseminate sensitive investment information.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The mode explicitly states that Radar must not write to Decision Memory, but later introduces automatic writes under a `.workbuddy/decision_memory/...` path. This creates a boundary-confusion issue: automation or downstream components may treat Radar research artifacts as institutional memory, causing unauthorized persistence, cross-mode data contamination, or incorrect reuse in later investment workflows.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger list includes broad natural-language phrases such as common investment workflow terms, which increases the chance of accidental invocation in unrelated conversations or documents. In this context, unintended activation is meaningful because the skill can route into analysis flows, read local mandate data, and persist outputs, potentially causing unauthorized processing of confidential financial material.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The routing table relies on ambiguous examples like '过一下', '上会', or '这个项目现在怎么样', which can match ordinary discussion rather than a deliberate request to run the skill. In a high-sensitivity investment setting, ambiguous routing can trigger the wrong mode, causing unintended recall of historical decisions, creation of artifacts, or capture into memory.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill permits autonomous local persistence and Tencent Docs document creation, but the user-facing warning language focuses on investment-decision disclaimers rather than data-handling consequences. Because this agent processes potentially confidential deal, portfolio, and government-linked investment data, insufficient disclosure around storage, retention, and external document creation can lead to inadvertent leakage, over-retention, or unauthorized sharing.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The file explicitly directs persistent storage of highly sensitive investment decision, outcome, and learning data into workspace JSONL files, while only later mentioning a privacy boundary. It does not provide an immediate operational warning, consent checkpoint, minimization guidance, or handling safeguards at the point of write, which creates a real risk of confidential GP/IC data being stored in insecure or synced workspaces and later exposed.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs persistent storage of sensitive fund mandate information in `config/mandate.json` but does not disclose that this data will be stored locally or discuss retention, access controls, or handling expectations. In this context, the stored fields can include investment constraints, LP composition, capital source, and government requirements, which are commercially sensitive and could be exposed to other users, tools, or processes on the same system.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill requires persistent storage of a Decision Object for every screening outcome, including rejected deals, but provides no user-facing notice, consent flow, retention limit, or data-minimization guidance. In an investment-screening context, these records may contain sensitive company, founder, regional, and compliance-related information, so silent retention can create privacy, confidentiality, and regulatory risk.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The routing guidance tells the agent to send uncertain requests directly to Radar based on broad phrases like 'weekly report' or 'industry radar' without strong exclusion checks. In a multi-mode investment assistant, this can misclassify requests containing evaluation or decision content, bypassing stricter project-analysis gates and causing sensitive or action-oriented tasks to be handled as lower-control market intelligence.

Static analysis

No suspicious patterns detected.