Security audit

Tech Earnings Deep Dive

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed financial-analysis prompt package, with no code execution or persistence, but users should be aware that its activation wording and README install URL are broad.

Install only from the reviewed ClawHub package or a pinned, trusted release rather than the README's raw main-branch URL. Treat outputs as research support, not financial advice, and override the skill when you want a narrower answer or a different language.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

Location: README.md:47
Finding: Mutable Remote Skill Package Installed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `README.md:47` and `README.md:160` **Vulnerability Type**: Mutable remote payload retrieval **Risk Level**: Medium ### Vulnerable Code The same installation instruction appears in both the Chinese and English documentation: ```text /install-skill https://github.com/Day1Global/Day1Global-Skills/raw/main/tech-earnings-deepdive.skill ``` ### Technical Analysis The documented command installs a Skill package directly from the mutable `main` branch of an external GitHub repository. It does not pin the package to a reviewed commit or immutable release and provides no checksum or cryptographic signature for integrity verification. Consequently, the effective package installed by this command can change after the audited project snapshot has been reviewed. The referenced `tech-earnings-deepdive.skill` package is not included in the audited project, which contains only `README.md` and `SKILL.md`; therefore, the remote package's contents and behavior could not be verified during this audit. This matches remote payload retrieval because the installation command fetches agent instructions from an external location whose contents remain under remote control. ### Attack Path 1. An attacker compromises an upstream maintainer account, repository access token, GitHub organization, or another mechanism capable of modifying the `main` branch. 2. The attacker replaces or modifies `tech-earnings-deepdive.skill` with attacker-controlled instructions or content. 3. A user follows the documented `/install-skill` command. 4. The installer retrieves the current attacker-controlled package rather than the version originally reviewed. 5. When the installed Skill is activated, its malicious instructions execute within the capabilities available to the host agent. ### Impact Assessment Successful exploitation could alter the installed agent's behavior and grant the malicious Skill access to any tools, data, network operations, ...[truncated 565 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the download URL to a specific reviewed Git commit rather than the mutable `main` branch: ```text https://raw.githubusercontent.com/Day1Global/Day1Global-Skills/<full-commit-hash>/tech-earnings-deepdive.skill ``` 2. Prefer an immutable, versioned release artifact with repository protections enabled. 3. Publish a SHA-256 digest or cryptographic signature for the package and require users or the installer to verify it before installation. 4. Include the exact distributable package in the audited repository so its contents can be reviewed alongside `SKILL.md`. 5. Protect release workflows with mandatory review, branch protection, least-privilege credentials, and signed commits or tags. 6. Update both duplicated installation instructions at `README.md:47` and `README.md:160` so neither language variant continues to recommend the mutable URL. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Vague Triggers

High

Confidence: 95% confidence
Finding: The skill description uses mandatory language like '务必使用此技能' and explicitly expands to broad, common investing prompts, which can override normal routing judgment and cause the agent to invoke this skill for many loosely related requests. In a financial-analysis context, this creates prompt-scope hijacking risk: the skill can dominate conversations, suppress better-matched tools, and steer outputs into a prescribed workflow even when the user asked for something narrower or different.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill claims it should activate for a very wide range of earnings, valuation, and portfolio-decision questions without defining clear exclusion criteria or precedence rules. In a multi-skill environment, this can cause unintended invocation, overshadow more appropriate skills, and steer user interactions into investment-analysis workflows when the user intent is only loosely related.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger examples are expansive and only show positive matches, which encourages over-triggering because there are no counterexamples showing when the skill should stay inactive. That ambiguity can be exploited by ordinary phrasing to force this skill into contexts like generic investing discussion, portfolio management, or comparisons better handled by other tools.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: Stating that the skill 'automatically activates' on 'relevant topics' is underspecified and leaves the activation boundary entirely subjective. Subjective routing logic increases the chance of accidental or excessive invocation, which can distort tool selection and make the system easier to prompt-route in unintended ways.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The English trigger description mirrors the same overbreadth as the Chinese section, broadening the risk across multilingual interactions. Because it covers many common investing prompts, it increases the probability that the skill captures traffic outside its intended earnings deep-dive scope.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The English use-case examples are broad and do not define exclusions, so they function like permissive routing patterns rather than scoped examples. In practice, this can cause the skill to activate for routine investing questions that lack earnings-specific intent, leading to misrouting and unnecessary influence over responses.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The phrase that the skill activates automatically when it detects 'relevant topics' is ambiguous and effectively delegates routing to an undefined heuristic. Undefined heuristics are dangerous in agent ecosystems because they enable prompt collisions, overreach into adjacent domains, and unreliable skill selection behavior.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The skill metadata and description are written to enforce Chinese-language behavior without checking the user's language preference, which can cause the agent to respond in an unexpected language or degrade accessibility and instruction alignment. In practice this is a control-flow and user-intent issue: it may override the user's preferred language, reduce transparency in a high-stakes financial context, and make outputs less reviewable by some users.

Static analysis

No suspicious patterns detected.