Security audit

Warren Buffett Investing Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown-only Warren Buffett investment-style skill with no executable behavior, but users should treat its financial examples as general education rather than personal advice.

Install only if you want a Buffett-style educational investment framework. Do not treat its sample allocations, stock comments, or buy-more language as personalized financial advice, and verify current facts and suitability before making any real investment decision.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill provides concrete allocation and buy/hold guidance such as recommending a 90/10 portfolio and advising users to buy more after large price drops, but it does not include any warning that this is generalized educational content rather than personalized financial advice. Users may rely on the examples as actionable recommendations despite differences in risk tolerance, liquidity needs, tax situation, time horizon, or legal suitability requirements.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The summary tells users that if they can answer all eight questions confidently, the investment is likely worth pursuing, which can be interpreted as an endorsement to proceed with real financial decisions. Because the skill omits caution about uncertainty, model error, changing market conditions, and the need for professional advice, it may encourage overconfidence and harmful financial actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The statement 'All original English quotes' imposes an English-language constraint in the document's content without offering an alternative language or explaining why English is required. Under the policy, language-specific requirements can be a natural-language policy issue unless they are optional or clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The sentence 'Original English quotes preserved throughout' reinforces a fixed language choice. Because the file does not mention user language options or a documented reason for restricting quotes to English, this may conflict with the language/locale policy guidance.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file includes natural-language statements that the content is limited to English quotes, which can amount to a language-policy constraint without any opt-in or alternative locale handling. Because SQP-3 applies to all file types and specifically covers forced language/locale choices, this is a policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The document states "Original English quotes" and closes with "All quotes original English," but line L290 includes the Russian word "рыба" inside an example. This creates an avoidable language inconsistency in a file that otherwise presents itself as English-only, with no explanation or user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Line L003 states 'All cases with original English quotes,' which imposes a specific language requirement in the document. Under the policy, forcing a language without user opt-in or a clearly documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.