AI财报分析

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:47 AM UTC
• Version: 1.0.2

Overview

The skill is a finance-report helper, but it asks for command execution and describes sensitive financial data/API workflows without enough scoping or privacy disclosure.

Review this before installing. Do not grant command execution or upload confidential financial reports unless you are comfortable with the external service, dependency installation, and API-key handling. Prefer a version that removes exec, pins dependencies, and clearly documents where financial data is sent, stored, and deleted.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:24

Finding

Unnecessary Execution Capability Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:24-26; duplicated in SKILL.md.bak_v161test:29-31
Vulnerability Type: Excessive tool permissions
Risk Level: Medium

Complete Code Snippet:

yaml

tools:
  - read
  - exec

Technical Analysis

The skill declares access to the exec tool even though the package contains only Markdown documentation and no implementation that requires command execution. Granting shell or process-execution capability expands the agent's authority beyond the demonstrated requirements of financial-report analysis.

The documentation also classifies the skill as requiring execution support, but it does not define an execution allowlist, command validation rules, sandbox restrictions, or user-confirmation requirements. If instructions, financial-report content, or other untrusted input influence later agent behavior, the unnecessarily available execution tool could turn a content-level attack into local command execution.

No direct malicious command invocation was found. The risk arises from the unjustified capability declaration and absence of compensating controls.

Attack Path

1. A user installs or loads the skill on an agent platform.
2. The platform grants the skill access to the declared exec tool.
3. The agent processes an untrusted financial report or other attacker-controlled content.
4. Malicious or misleading content causes the agent to attempt an unnecessary command.
5. Because execution capability was pre-authorized, the command may run with the agent process's operating-system privileges.

Impact Assessment

Successful exploitation could permit command execution with the privileges of the agent process. Depending on platform sandboxing, this could expose local files, environment variables, credentials available to the process, or network-accessible resources. The potential scope is the execution environment assigned to the agent; no evidence e ...[truncated 47 chars]

Remediation

View remediation

Remediation Suggestions

• Remove exec from the declared tools because the reviewed package contains no implementation requiring it.
• If execution is added later, use a narrowly scoped tool instead of unrestricted command execution.
• Enforce an explicit command and argument allowlist.
• Run commands in an isolated, non-privileged sandbox with restricted filesystem and network access.
• Require explicit user approval before executing installation commands or commands derived from document content.
• Prevent untrusted financial-report text from being interpreted as executable agent instructions.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:212

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:212-215; duplicated in SKILL.md.bak_v161test:199-202
Vulnerability Type: Mutable and non-reproducible dependency installation
Risk Level: Medium

Complete Code Snippet:

markdown

### Environment Requirements
- **Python version**: Python 3.7+
- **Dependency installation command**: `pip install numpy pandas scikit-learn tensorflow`

Technical Analysis

The installation command retrieves four packages without pinning versions or verifying package hashes. Consequently, the installed artifacts depend on whichever releases and transitive dependencies the package index serves at installation time.

Python packages may execute build or installation logic. A compromised upstream release, compromised transitive dependency, unsafe package-index configuration, or future incompatible release could therefore introduce code that was not present during this audit. The broad Python requirement also permits obsolete Python environments for which current security support may be unavailable.

The reviewed package contains no lockfile, hash manifest, dependency constraints, or documented trusted index. It also does not contain the documented ai_report_free module, and the listed installation command does not explicitly install that module.

Attack Path

1. A user follows the documented pip install command.
2. pip resolves the latest compatible versions and their transitive dependencies from its configured index.
3. A compromised or unexpectedly modified package artifact is downloaded.
4. Package build or installation code executes in the user's Python environment.
5. The installed component subsequently runs with the privileges available to the Python or agent process.

Impact Assessment

A compromised dependency could execute arbitrary Python or native code, read files accessible to the installation process, access environment variables, modify the ...[truncated 289 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to a reviewed version.
• Resolve and lock all transitive dependencies using a reproducible lockfile.
• Require cryptographic hashes, such as with pip install --require-hashes.
• Document and enforce an approved HTTPS package index.
• Install dependencies in an isolated virtual environment or container using a non-privileged account.
• Run software-composition analysis and vulnerability scanning against the locked dependency set.
• Define a currently supported Python version range.
• Add the actual ai_report_free implementation or remove instructions that refer to a nonexistent module.

other

Warning

• Location: SKILL.md.bak_v161test:668

Finding

External Upload of Potentially Sensitive Financial Reports Without Adequate Disclosure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md.bak_v161test:668-670
Vulnerability Type: Potential sensitive-data disclosure
Risk Level: Medium

Complete Code Snippet:

markdown

| Step | Operation | Expected result |
|------|-----------|-----------------|
| 1 | Visit the AI financial-report free-edition website at https://skillhub.cn |
| 2 | Register an account and sign in | Obtain a personal workspace |
| 3 | Upload a financial-report file | The system automatically parses it and generates analysis results |

The snippet above is an English rendering of the reviewed instructions so that the report complies with the required output language.

Technical Analysis

The backup documentation directs users to register with an external service and upload financial-report files. Financial reports may contain confidential company information, personal data, customer details, internal forecasts, or non-public investment information.

The upload workflow does not state which entity processes the file, what information is collected, where it is stored, how long it is retained, who can access it, or how users can delete it. It also does not require redaction or explicit informed consent before transmission.

This instruction conflicts with the backup file's later statement that user data is stored only in a local working directory and is not uploaded to third-party servers. The contradictory representations prevent users from making an informed data-handling decision.

No evidence establishes that the external service acts maliciously. The confirmed issue is that the documented workflow sends potentially sensitive material outside the local environment without adequate disclosure or safeguards.

Attack Path

1. A user follows the quick-start instructions in the backup file.
2. The user creates an account on the referenced external website.
3. The user uploads a financial report containing potentially ...[truncated 611 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the external-upload workflow unless remote processing is essential.
• Prefer local processing for confidential financial reports.
• Before any upload, clearly identify the data processor and provide applicable privacy and security terms.
• Disclose collection purposes, storage locations, subprocessors, retention periods, access controls, and deletion procedures.
• Require explicit informed user consent before transmitting a report.
• Warn users not to upload confidential, regulated, or non-public information without authorization.
• Provide a redaction workflow that removes personal data, credentials, account identifiers, and confidential metadata.
• Encrypt uploads in transit and stored reports at rest.
• Reconcile or remove the contradictory claim that all user data remains local and is never uploaded to third parties.
• Exclude backup documentation from distributed packages when it contains obsolete or contradictory workflows.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill’s documented interface expands far beyond finance-report analysis into broad market data lookup, crypto monitoring, exporting, alerting, and portfolio functions. This kind of scope drift is dangerous because it changes the trust boundary: users or orchestrators may grant tools and data access appropriate for a narrow reporting skill, while the skill description quietly enables broader networked monitoring and data-handling behaviors.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill claims that risky code was removed and security was enhanced, yet the manifest still retains executable-command capability. This contradiction can mislead reviewers and users into trusting the skill more than warranted, which is especially dangerous because 'safe/verified' style assurances should increase suspicion when paired with powerful permissions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest grants exec capability even though the documented purpose is financial-report analysis and the file provides no narrowly scoped justification for arbitrary command execution. In an agent environment, unnecessary execution permissions expand the attack surface and can enable local command execution, data access, or pivoting if later instructions or inputs are abused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill exposes command execution capability in the manifest but does not provide a clear user-facing warning that running the skill may execute local commands. In practice, this can cause users or higher-level agents to invoke the skill without understanding that it could affect the host environment, files, or network state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill describes API-based integration and external financial data access but does not clearly warn users that submitted financial data or identifiers may be transmitted to third-party services. Because the context is finance analysis, inputs may include sensitive proprietary or investment-related information, making undisclosed data egress more dangerous than in low-sensitivity domains.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation advertises security optimization and removal of sensitive-risk paths, but later troubleshooting text explicitly discusses command execution failures and environment dependencies, indicating executable behavior is still expected. This inconsistency can conceal real operational risk and make unsafe capabilities seem sanitized when they are not.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Declaring the exec tool for a skill presented as a finance analysis/document-processing capability is over-privileged and not justified by the visible functionality. Even without embedded code execution instructions, unnecessary execution capability increases the blast radius if the skill is later paired with prompt injection, unsafe examples, or agent misinterpretation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The security section claims there is no exec/eval usage, but the manifest explicitly requests the exec capability. This contradiction is risky because it can mislead reviewers and users into trusting the skill as non-executing while it retains the ability to run commands through the agent platform.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill documents API-based real-time financial data integration and monitoring without a clear warning that user inputs, identifiers, or financial context may be transmitted to external services. This is dangerous because users may assume a local-only analysis workflow, while the skill’s described behavior implies outbound network sharing with third-party providers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill describes exporting and locally storing user financial data, but does not present a clear, explicit warning about privacy, retention, access scope, or downstream handling risks. Financial data is sensitive, and vague storage/export language can lead users to disclose or persist confidential information without informed consent or proper safeguards.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.