Security audit

Phil Fisher Investing Skill

Security checks across malware telemetry and agentic risk

Overview

This is a text-only investing framework skill with broad activation phrases, but it does not run code, access credentials, persist, or take financial actions.

Install only if you want Phil Fisher-style long-term growth investing guidance. Be aware it may activate from broad terms in ordinary finance discussions, and treat its outputs as educational investment philosophy rather than personalized financial advice or permission to trade.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger phrase "growth investing" is broad and commonly used in ordinary finance discussions, so it can cause unintended skill invocation outside cases where the user actually wants the Phil Fisher persona/framework. This increases the chance of context hijacking or inappropriate mode-switching, especially in multi-skill environments where generic financial terms appear frequently.

Vague Triggers

Low

Confidence: 70% confidence
Finding: The term "scuttlebutt" is less common than generic investing language, but it still has non-skill meanings and may appear in unrelated conversations. On its own, it is not a reliable invocation signal and could activate the skill when the user is discussing the concept generally rather than requesting this specific skill.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: "Motorola" is a widely used brand and may be mentioned in historical, consumer, legal, or technology discussions unrelated to Phil Fisher. Using it as a standalone trigger creates a meaningful risk of accidental invocation whenever the company is referenced.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The phrase "hold forever" is common everyday investing language and appears broadly across portfolio, retirement, and personal finance discussions. As a trigger, it is highly collision-prone and can cause the skill to activate in many unrelated contexts, leading to unintended behavioral steering.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger phrase "growth investing" is broad and commonly used in ordinary finance discussions, so this skill may activate unintentionally in many contexts unrelated to Phil Fisher specifically. That can cause prompt/skill injection of irrelevant instructions or content into unrelated conversations, reducing routing integrity and potentially influencing outputs when users did not request this skill.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The standalone trigger "Fisher" is ambiguous because it is a common surname and may refer to many people, firms, or topics. This increases the chance of accidental invocation, which can inject this skill's behavior into unrelated requests and degrade correctness or create an avenue for unintended prompt influence.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.