Norman: Financial Overview

• Outcome: Pass
• Latest audit: May 28, 2026 at 4:35 AM UTC
• Version:
  1.0.1

Overview

This skill is a straightforward financial overview helper that accesses sensitive business finance data only for its stated purpose.

Install only if you trust the Norman Finance MCP integration and want the agent to see business balances, transactions, invoices, and tax information. Use it in private conversations, and phrase requests clearly if you want only a narrower financial answer instead of a full overview.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger description is broad enough to match many generic finance-related user requests such as dashboard, summary, or business status, which can cause the skill to be invoked when the user did not explicitly ask for a full financial aggregation. Because the skill pulls data from multiple sources including balances, transactions, invoices, and tax information, unintended invocation could expose more sensitive financial data than necessary.

VirusTotal

66/66 vendors flagged this skill as clean.