Security audit

Finance LITE

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly provides finance-analysis guidance, but it also describes command execution, file writing, external APIs, and API keys despite being declared as a read-only Markdown skill.

Review carefully before installing. The finance formulas and examples appear usable, but the publisher should remove or tightly scope the unrelated command, API, API-key, and file-writing language so users and agents know this is only a read-only finance-analysis skill.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The skill is declared as a read-only finance analysis Markdown skill, but later advertises file writing, external API use, and system command execution as core capabilities. This creates capability confusion and can cause an agent or reviewer to trust the skill for low-risk use while the instructions normalize higher-risk behaviors unrelated to the stated purpose.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The file classifies itself as pure Markdown not requiring command execution, yet elsewhere instructs users to run ping and describes command-execution capability. This contradiction is dangerous because it masks operational behavior and can be used to socially engineer an agent or operator into invoking commands outside the declared trust boundary.

Intent-Code Divergence

Medium

Confidence: 82% confidence
Finding: The top-level description presents the skill as basic offline-style financial analysis and says it is unsuitable for real-time scenarios, but the document also references API-key configuration and API integration behavior. While not immediately exploitable on its own, this inconsistency broadens the apparent operating scope and can mislead users about what data flows or external dependencies the skill may invoke.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: Introducing system command execution in troubleshooting is unjustified for a basic financial analysis skill with only read permissions. Even without an exec tool declared, these instructions encourage operators or future agents to perform unnecessary system-level actions, expanding attack surface and blurring least-privilege expectations.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: Claiming external API integration as a core capability is unjustified by the stated purpose and inconsistent with a simple finance-analysis skill. This can normalize unnecessary outbound data handling and make users more willing to expose financial or operational data to unspecified external services.

Static analysis

No suspicious patterns detected.