Security audit

Langchain V1 Toolkit

Security checks across malware telemetry and agentic risk

Overview

The skill is advertised as a LangChain toolkit, but its main instructions define a finance/backtesting workflow that can install packages, use local data stores, and write outputs.

Review before installing. Use this only if you intentionally want a ZVT finance/backtesting assistant, not a LangChain-only toolkit. Do not allow package installs, recorder runs, file writes, provider credentials, or broker-related access unless the package is renamed, scoped, and its finance behavior is clearly disclosed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The human summary is materially inconsistent with the declared skill metadata: it presents a finance/ZVT quant-trading assistant instead of a LangChain v1 toolkit skill. This kind of semantic mismatch can mislead users and downstream agents into invoking the skill for unintended purposes, causing prompt/goal confusion, unsafe tool use, or policy bypass if routing and trust decisions rely on the summary.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file materially misrepresents the skill's purpose: metadata says it is a LangChain v1/LCEL toolkit, but the body defines a finance/ZVT trading and backtesting workflow with installation, execution, persistence, and validation behavior unrelated to the declared scope. This kind of scope deception is dangerous because users or host systems may grant permissions, route requests, or trust the skill under false assumptions, enabling unintended code execution, package installation, and financial-task behavior.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The user-facing summary advertises A-share quant strategy building and ZVT workflows rather than LangChain composition, confirming that the skill content is inconsistent with the declared metadata and likely intended audience. This increases risk because users invoking a seemingly benign developer toolkit may instead trigger a finance-oriented automation flow with different dependencies, side effects, and safety expectations.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill contains execution logic for finance trading/backtesting, including strategy scaffolding, output paths, validation, and execution modes, which are unjustified for a LangChain toolkit. Hidden or undeclared execution capability is dangerous because it expands the skill's operational power beyond user expectation and could cause local code execution, data manipulation, or financially sensitive actions under an unrelated label.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill requires local ZVT data stores, initialized directories, and write-capable filesystem/database setup unrelated to the stated LangChain toolkit purpose. This is dangerous because it introduces unexpected persistence and local environment modification, increasing the blast radius if the skill is installed or executed under the assumption that it is only a chain-composition helper.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The post-install and human-summary content directly contradict the manifest by positioning the skill as a ZVT A-share quant assistant instead of a LangChain v1 toolkit. Contradictory identity and capability messaging is dangerous because it can be used to socially engineer trust, bypass review heuristics based on metadata, and confuse operators about what the skill will actually do.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The instruction to automatically translate all fields into the detected user locale on first contact performs inferred-locale transformation without explicit user consent. In an agent setting, this can alter exact security-relevant wording, create ambiguity around preserved tokens, and increase the chance of misunderstanding or data handling inconsistent with user expectations.

Vague Triggers

High

Confidence: 95% confidence
Finding: The execute trigger fires when user intent matches broad positive terms and uses generic action verbs like run/execute/fetch/collect, which can cause unintended invocation. In a skill that can install packages, run checks, access local data, and generate execution workflows, overly broad triggering materially raises the risk of accidental or coerced activation.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The use-case trigger phrases are broad and lack contextual constraints or negative examples, making false activation more likely. Given the skill's misleading scope and execution-oriented behavior, ambiguous trigger matching can route innocuous LangChain-related requests into finance/trading-oriented flows or other unintended operations.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.