Security audit

Accounting And Finance

Security checks across malware telemetry and agentic risk

Overview

This finance skill is not clearly malicious, but it asks for broad read/write/command authority that is not well scoped or consistently disclosed.

Review this skill before installing. It may be useful for finance analysis, but only grant it read/write/exec access in a controlled workspace, avoid confidential financial data unless you understand where callbacks and APIs may send it, and require explicit approval for any file write, external request, or command execution.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The skill claims it is pure Markdown and does not require exec, yet the manifest explicitly enables exec and later sections advertise command execution. This mismatch can mislead users and host agents into granting or invoking unnecessary command-execution privileges, expanding the attack surface far beyond the stated finance-analysis purpose.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The skill presents itself as a finance-analysis tool but includes broad file handling, API integration, and command-execution capabilities unrelated to its core function. Overbroad capabilities create a privilege-escalation path where finance-related prompts could be used as a pretext to read/write arbitrary data, call external services, or run system commands.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The manifest markets the skill as a specialized financial analysis tool, but the document also advertises broader automation behaviors such as external API usage, file writing, and command execution. This capability masking is dangerous because reviewers or users may trust and enable the skill under a narrow finance label while unknowingly granting broader operational powers.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation rule 'use when user needs finance-related functionality' is overly broad and can cause the skill to trigger on common requests without sufficient user intent or context. In a privileged skill, loose activation increases the chance of unnecessary invocation and accidental access to data or capabilities the user did not specifically request.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill mentions callback_url and external/API-style behavior without clearly warning that user-supplied data or analysis results may be transmitted to third parties. In a finance context, this is particularly risky because inputs may include confidential financial statements, internal forecasts, or other sensitive business data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.