Security audit

broker-monitor

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent financial reporting skill that gathers public market data and writes local report/database outputs, with some usability and data-retention caveats.

Install this if you want a Chinese-format weekly broker and trading-ecosystem monitor. Before use, be aware it will research current market data, read an uploaded Excel workbook when present, create an updated workbook and report in the outputs folder, and dashboard entries may persist locally until cleared.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger conditions are excessively broad, including generic phrases like 'weekly update', 'review', and broad market terms that could cause this skill to activate for unrelated financial or reporting requests. Over-broad invocation is dangerous because it can route users into a workflow that performs unnecessary data gathering and file operations, increasing the chance of unintended actions and disclosure or modification of user data.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The file specifies Chinese output elements such as '牛熊周期定位' and later mandates multiple Chinese-titled report sections and filenames, but it does not state that language selection is optional or user-configurable. This creates a locale-policy issue because the skill appears to force a specific language format regardless of user preference.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill directs the agent to open a user-uploaded Excel file, append data, create missing sheets, and save outputs, but it does not require explicit user confirmation before modifying files or clearly warn the user that file contents will be changed. This is risky because unintended file modification can corrupt user workflows, overwrite expected structures indirectly, or create trust and integrity issues around user data handling.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The template hardcodes the report title and, by implication, the report format in Chinese. This is a natural-language locale choice imposed by the skill content, and the file does not offer an alternative language option or indicate that Chinese is optional or region-specific.

Natural-Language Policy Violations

Low

Confidence: 80% confidence
Finding: The file hardcodes Chinese labels and UI strings such as "YYYY年M月", "跨公司对比", and "数据录入" while other text is in English. This creates an implicit locale requirement without stating that the skill is Chinese-only, region-specific, or that users can choose another language.

Missing User Warnings

Low

Confidence: 94% confidence
Finding: This markdown file documents that dashboard data "auto-saves to persistent storage," and earlier specifies the use of persistent browser storage across sessions. Because persistent storage affects user data retention and privacy, the skill description should explicitly warn users that entered data will be stored locally and persist until cleared or overwritten.

Static analysis

No suspicious patterns detected.