Security audit

Ifrs9 Loss Engine

Security checks for vulnerabilities and agentic risk

Overview

The skill is labeled as an IFRS 9 credit-loss tool, but its files also steer the agent toward stock/crypto strategy building, market-data collection, backtesting, and broker-style trading workflows.

Install only after reading the files carefully and only if you intentionally want ZVT quant/backtesting assistance, not a clean IFRS 9 ECL-only tool. Use an isolated environment, avoid broker or paid-data credentials unless they are sandboxed or read-only, and require manual confirmation for any trade, purchase, or account-affecting action.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The skill claims to be an IFRS 9 ECL loss engine, but its pipeline, triggers, and prompts describe securities data collection, factor computation, backtesting, and trading execution. This capability mismatch is dangerous because users or an orchestrator may invoke the skill under a compliance/credit-risk label while actually enabling trading-related actions, creating scope confusion and possible unauthorized financial operations.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The documented capabilities include trading execution and backtesting, which are unjustified for a stated IFRS 9 expected credit loss calculator. In a financial-agent environment, this kind of hidden or mislabeled expansion of scope can lead to execution of market actions under the guise of risk analytics, bypassing user expectations, review controls, or permission boundaries.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The inline documentation repeatedly frames the skill as a trading/backtesting system despite the declared IFRS 9 loss-engine purpose. Contradictory documentation increases the chance of operator error, unsafe orchestration, and accidental exposure of higher-risk financial actions because consumers cannot reliably determine the skill's true behavior.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The human summary is materially inconsistent with the declared skill purpose: the manifest says this skill computes IFRS 9 expected credit losses, while the summary advertises quant trading and backtesting with ZVT. This kind of capability mismatch can mislead users and downstream agents into invoking the wrong workflows, handling inappropriate financial data, or trusting outputs produced under false assumptions about the skill’s function.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file for an IFRS 9 ECL computation skill defines semantic locks and preconditions for an unrelated stock-trading/backtesting framework, including trade execution ordering, MACD parameters, A-share T+1 rules, and zvt market-data initialization. This mismatch is dangerous because it can cause the agent to install finance-trading dependencies, access market data, or operate under irrelevant trading assumptions that materially expand capability and attack surface beyond the declared purpose.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The preconditions explicitly instruct the environment to import zvt, initialize its directories, and fetch stock market kdata, which are unjustified capabilities for an IFRS 9 loss engine. If acted on by an agent, this could trigger unnecessary package installation, local filesystem modification, and external market-data access, violating least privilege and enabling unintended behavior outside the credit-risk domain.

Description-Behavior Mismatch

Critical

Confidence: 99% confidence
Finding: The seed advertises an IFRS 9 ECL engine, but major sections define a different capability set: ZVT trading/backtesting workflows, trading semantic locks, A-share prompts, and backtest validators. This is dangerous because users and hosts may invoke market-trading behaviors, install unrelated tooling, or trust compliance outputs under a false finance-risk-engine label, creating scope confusion and unsafe execution of unintended capabilities.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Embedding trading and backtesting capabilities in a loss-engine skill expands the executable surface far beyond the declared business purpose. In context, this is especially risky because the skill is presented as a regulated IFRS 9 tool, so users may unknowingly authorize unrelated market actions or code generation paths that are not expected in a credit impairment workflow.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill installs and depends on the ZVT trading stack despite claiming IFRS 9 ECL functionality. That mismatch can trigger unnecessary package installation, broaden supply-chain and execution risk, and mislead operators into trusting a credit-risk skill that is actually wired to market-data/trading infrastructure.

Intent-Code Divergence

Critical

Confidence: 99% confidence
Finding: The user-facing documentation explicitly says the skill helps build A-share quant strategies with ZVT, directly contradicting the IFRS 9 loss-engine description. This is dangerous because user-facing copy controls trust and invocation behavior; misleading documentation can cause users to disclose the wrong data, run the wrong workflows, and accept outputs under a false regulatory/compliance context.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The execute trigger allows activation whenever intent matches positive terms and the user uses a broad action verb such as run, execute, fetch, or collect. Such loose activation criteria can cause unintended invocation, especially in agentic systems where normal user phrasing may incidentally satisfy the trigger and start higher-risk workflows.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The listed trigger keywords are generic terms like ECL, amortization, loan, and payment schedule, which can appear in normal discussion without intent to activate a skill. Generic triggers increase accidental activation risk and are especially concerning here because the documented workflow includes unrelated trading and execution behavior.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The execute trigger matches generic action verbs like run/execute/fetch/collect combined with broad positive terms, which can cause accidental invocation on ordinary requests. In a skill already suffering scope confusion, broad triggering becomes more dangerous because unintended execution may activate unrelated trading or external-data behaviors without clear user intent.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: The post-install prompt encourages generic invocation phrases without clarifying boundaries or giving non-triggering examples. That increases the chance that users invoke the skill unintentionally, which is more concerning here because the skill already mixes incompatible domains and may execute workflows the user did not mean to authorize.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The manifest includes external API fetching and credential handling but lacks a clear user-facing disclosure that requests, identifiers, and authentication material may be sent to third-party services. This creates consent and data-governance risk, especially in a finance context where macroeconomic or portfolio-related requests may be sensitive and subject to internal control requirements.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The skill forces an A-share/ZVT framing in user-facing positioning despite claiming global regtech coverage and locale-aware behavior. This can steer users into a market-specific workflow without informed choice, and in this file that steering is more dangerous because the market workflow is itself unrelated to the stated IFRS 9 purpose.

Natural-Language Policy Violations

Medium

Confidence: 81% confidence
Finding: The human summary hard-codes an A-share default and dismisses another market without user choice. While not code-execution by itself, it biases user behavior and can cause inappropriate use of the skill in the wrong domain or market context, compounding the broader misrepresentation problem already present in the file.

Static analysis

No suspicious patterns detected.