AI驱动金融分析

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:47 AM UTC
• Version: 1.0.2

Overview

The skill is not overtly malicious, but it asks for broad file and shell access and gives unsafe setup guidance that users should review before installing.

Install only if you are comfortable granting this skill broad local file and command capabilities. Use a non-privileged account, avoid running it as administrator, keep financial API keys scoped and revocable, and do not follow the unpinned pip install instruction without verifying the package source and version.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:36

Finding

Unverified and Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:36
Vulnerability Type: Supply-chain exposure through an unpinned package installation
Risk Level: High

Complete Source Snippet:

markdown

| 依赖缺失 | Python环境未安装ai_finance库 | 执行`pip install ai_finance`安装依赖 |

The source instructs the user to run pip install ai_finance when the dependency is unavailable.

Technical Analysis

The installation command retrieves the latest package published under the ai_finance name from the package index configured for pip. It does not specify:

• An audited package version
• An expected package hash
• A trusted package index
• The publisher or official package provenance
• A lockfile or other reproducible dependency manifest

Python packages can execute package-controlled code during installation or when imported. Consequently, dependency confusion, account compromise, package replacement, or an incorrect package name could cause unreviewed code to execute locally. The artifact itself contains no Python implementation demonstrating why this package is required, and the package is not consistently documented in the later dependency table.

This finding does not establish that the current ai_finance package is malicious. The vulnerability is the instruction to install an unverified and mutable third-party dependency.

Attack Path

1. The skill reports or encounters a missing ai_finance dependency.
2. The user or an agent follows the documented troubleshooting instruction.
3. pip resolves ai_finance from the configured package index without enforcing an approved version or hash.
4. An attacker-controlled, compromised, or unintended distribution is downloaded.
5. Package installation hooks or a later import execute package-controlled code.
6. The code runs with the privileges of the user executing pip; this impact increases if installation is combined with the document's administrator-elevation ...[truncated 485 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the installation instruction unless a concrete, reviewed implementation requires the package.
2. Verify the official package name, publisher, source repository, and expected registry.
3. Pin the dependency to a reviewed version, for example through a locked requirements file.
4. Enforce package hashes with pip install --require-hashes.
5. Configure an explicitly trusted package index rather than relying on ambient pip configuration.
6. Install dependencies in an isolated virtual environment under a non-privileged account.
7. Add the dependency and its purpose to the formal dependency table.
8. Perform software-composition analysis and package integrity checks before release.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:9

Finding

Excessive Shell and Filesystem Capabilities for a Documentation-Only Skill

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:9-13
Vulnerability Type: Violation of least privilege through unnecessary agent tools
Risk Level: High

Complete Source Snippet:

yaml

tools:
  - Read
  - Write
  - Edit
  - Bash

Technical Analysis

The skill requests unrestricted reading, writing, editing, and shell execution capabilities. However, the reviewed artifact contains only a Markdown skill definition and no implementation scripts that establish a legitimate need for general-purpose shell execution or unrestricted filesystem modification.

Bash can execute arbitrary commands available to the agent's operating-system account. Write and Edit can modify files within the scope allowed by the hosting platform. These capabilities substantially exceed what is required for conversational financial analysis and increase the consequences of malformed instructions, prompt injection in financial content, or agent interpretation errors.

The configuration does not define command allowlists, path restrictions, confirmation requirements, execution isolation, or output-directory boundaries.

Attack Path

1. The skill is loaded with the declared Bash, Write, and Edit tools.
2. A user supplies financial data or external content containing adversarial instructions, or the agent incorrectly interprets a broad workflow request.
3. The agent treats the embedded instruction as part of the requested analysis workflow.
4. The agent invokes Bash or modifies files through Write or Edit.
5. Commands or file changes execute with the permissions available to the agent process.
6. Accessible files, credentials, project content, or the local execution environment may be exposed or altered.

Impact Assessment

Exploitation could permit command execution and file modification within the agent process's operating-system permissions. Potentially affected assets include project files, use ...[truncated 252 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Bash, Write, and Edit unless each capability is required by a documented and reviewed workflow.
2. Prefer read-only operation for financial analysis that only consumes user-provided data.
3. If exports are required, limit writes to a dedicated output directory with generated filenames.
4. Replace unrestricted shell access with narrowly scoped, typed tools for specific financial-data operations.
5. Require explicit user confirmation before commands, file changes, exports, or network operations.
6. Apply command allowlists, argument validation, path canonicalization, and network destination restrictions.
7. Run the skill in a sandbox under a non-privileged account with minimal filesystem and environment-variable access.
8. Treat external financial reports, news, social-media content, and API responses as untrusted data rather than executable instructions.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:331

Finding

Unsafe Recommendation to Resolve Permission Errors by Running as Administrator

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:331
Vulnerability Type: Unsafe privilege-elevation guidance
Risk Level: Medium

Complete Source Snippet:

markdown

| 权限不足 | 当前用户无读写权限 | 检查文件权限,以管理员身份运行 |

The source recommends checking file permissions and running as administrator when the current user lacks read or write access.

Technical Analysis

The guidance treats administrator execution as a generic solution to a filesystem authorization failure. Permission failures are security boundaries and should ordinarily be resolved through correct ownership, narrowly scoped access-control changes, or selection of an authorized working directory.

Elevating the entire agent or installation process gives all subsequent shell commands, package installation steps, and file operations greater authority than the financial-analysis task requires. The document provides no procedure for verifying the command being elevated, limiting elevation to one operation, dropping privileges afterward, or distinguishing Windows administrator execution from Unix privilege elevation.

The instruction is advisory rather than an automatic privilege-escalation implementation. Nevertheless, following it creates a concrete unsafe operating condition, especially when combined with unrestricted Bash access and the unverified package-installation instruction.

Attack Path

1. A file operation or package installation fails because the current account lacks permission.
2. The user follows the documented troubleshooting advice and restarts the agent, terminal, or command with administrator privileges.
3. The skill retains access to general-purpose shell and filesystem tools.
4. A malicious dependency, adversarial input, or incorrectly generated command is executed.
5. The operation now runs with elevated authority instead of being constrained to the original user account.
6. Protected files, system-wide configuration, or other ...[truncated 570 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the blanket recommendation to run the agent or command as administrator.
2. Direct users to verify the target path, ownership, and required access before changing permissions.
3. Store generated files in a user-owned application-data or output directory.
4. Apply the narrowest possible ACL or ownership correction only to the required path.
5. Use a non-privileged virtual environment for Python dependencies.
6. If elevation is genuinely required, document the exact reviewed command and reason, require explicit confirmation, and immediately return to a non-privileged context.
7. Prohibit elevated execution of package managers, unrestricted agent sessions, and commands derived from untrusted input.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The display name, summary, and primary description are presented in Chinese, and the examples throughout the document assume Chinese interaction, but there is no explicit user opt-in or statement that other languages are supported. This can amount to a language/locale constraint imposed by the skill's natural-language interface without offering a choice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description says the skill should be used 'when 用户需要AI驱动金融分析相关功能时使用,' which is a broad natural-language condition rather than a specific invocation scope. It does not provide concrete trigger phrases, constraints, or negative examples, increasing the chance of unintended activation for general finance-related requests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document states under '安全性优化' that it has removed external repository references and cleaned up possible sensitive information leakage paths, implying a hardened, low-risk skill. However, later sections explicitly require external financial data APIs and instruct users to configure API keys in environment variables, which contradicts the earlier claim of having removed such risk paths rather than merely managing them.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.