Security audit

Phy Founder Fundraising

Security checks for vulnerabilities and agentic risk

Overview

This is a fundraising-writing guidance skill with no executable code, privileged access, persistence, or hidden data handling.

Reasonable to install if you want fundraising templates and investor communication guidance. Be aware that the broad trigger term 'raise' may cause it to appear for some non-fundraising requests, and one referenced narrative file is not included in the artifact.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The trigger list includes very broad terms such as "raise" and "any investor/fundraising question," which can cause this skill to activate in contexts unrelated to fundraising. Unintended activation can override a more appropriate skill, expose irrelevant instructions to the model, and degrade reliability or safety routing.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: The skill's input/output examples use Chinese user prompts while the skill content and outputs are otherwise written in English, but the document does not state that language should follow the user's preference or offer a language choice. This can create an implicit locale expectation rather than an explicit opt-in language policy.

Natural-Language Policy Violations

Low

Confidence: 80% confidence
Finding: This example again uses a Chinese user prompt without any accompanying statement that the assistant should adapt to the user's chosen language. Repeated examples can effectively encode a language behavior, and the file does not document language selection or opt-in.

Natural-Language Policy Violations

Low

Confidence: 79% confidence
Finding: The third example continues the same pattern of Chinese-language user input with no natural-language policy guidance about locale or output language choice. Without such guidance, the skill may appear to assume a particular language behavior instead of making it user-directed.

Static analysis

No suspicious patterns detected.