Security audit

Firm Fintech Pack

Security checks for vulnerabilities and agentic risk

Overview

This fintech skill is mostly a static orchestration guide, but it asks for broad multi-session authority and recommends mutable network installs in a sensitive financial context.

Review this skill before installing in a financial environment. Only grant session history, session sending, and session spawning where there is explicit user approval, tenant isolation, redaction of customer and financial data, and audit logging. Avoid running the `npx ...@latest` companion install commands in production; use pinned, reviewed versions or an internal approved registry.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:48
Finding: Mutable Third-Party Packages and Skills Installed Without Integrity Verification
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:14
Finding: Overbroad Session Management Capabilities Declared Without Demonstrated Need
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description says the bundle 'Activates the firm pyramid' with multiple agents, but it does not specify the exact trigger phrases, invocation conditions, or any exclusion criteria. For a markdown/manifest file, this is overly vague and could cause unintended activation in broad fintech-related contexts.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill recommends installing tooling via npx clawhub@latest, which pulls the latest package version at execution time rather than a reviewed, fixed version. In a security-sensitive fintech context, this creates supply-chain risk: a compromised upstream release or unexpected breaking change could alter what gets installed and executed without notice.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This line repeats the use of npx clawhub@latest, causing the same unpinned remote package execution risk. Because the skill is aimed at fintech operations involving compliance and payment infrastructure, installing mutable dependencies from the network increases the chance of introducing malicious or unreviewed code into sensitive workflows.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Using npx clawhub@latest here means the installed tool is not reproducible and may differ over time. In regulated financial environments, that undermines change control and can expose users to package compromise, typosquatting-like replacement, or silent behavioral changes in an orchestration component.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The command on this line instructs users to fetch and run the latest clawhub package dynamically. That is dangerous because the package contents can change after the skill is published, turning documentation into an execution path for untrusted code, especially risky where transaction logs and counterparty verification are involved.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This recommendation again relies on npx clawhub@latest, exposing users to mutable third-party code execution. Given the skill bundle activates multiple departments and orchestration capabilities, a compromised installer could affect broad workflows or expose sensitive fintech data paths.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This line has the same supply-chain weakness: @latest causes non-deterministic package retrieval and execution. In a fintech skill that explicitly references audit trails and reporting/export functions, compromise of the installer or package could impact confidentiality, integrity, and compliance evidence generation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The support section switches to French ('Si ce skill vous est utile...') even though the rest of the file is in English, and there is no opt-in or explanation for the language choice. This can violate language/locale policy expectations when a skill imposes a language without user choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.