Security audit

AI财报分析

Security checks for vulnerabilities and agentic risk

Overview

This finance-analysis skill is not clearly malicious, but it asks for broad execution and financial-data handling authority while giving inconsistent scope and weak privacy controls.

Review before installing. Use only with financial data you are comfortable processing through the agent, avoid connecting sensitive portfolios or private statements until the publisher narrows the scope, and require explicit confirmation before package installs, command execution, API calls, monitoring, or exports.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill manifest says it is not intended for real-time stream processing, but later documentation introduces monitoring and realtime options. This mismatch can cause the agent to invoke the skill in higher-risk contexts than intended, increasing the chance of inappropriate execution, unexpected network activity, or unsafe handling of time-sensitive financial workflows.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The documented interface expands from financial report analysis into crypto monitoring and portfolio export, which is materially broader than the stated report/data-analysis purpose. Scope expansion increases the attack surface by enabling the skill to be selected for unrelated requests and potentially process or export sensitive financial data outside user expectations.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill claims removal of external dependencies and sensitive-information leakage paths, yet other sections explicitly require external APIs and API keys. This contradiction can mislead users and orchestrators about data exposure and trust boundaries, causing sensitive financial inputs to be sent to third-party services without informed consent.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The activation wording is extremely broad for analysis, reporting, statistics, and visualization, which makes the skill eligible for many generic prompts. Overbroad routing increases the chance that an exec-capable skill is selected unnecessarily, exposing users to unintended command execution or external data handling.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The natural-language examples include broad requests such as crypto monitoring and exporting asset portfolios, which extend far beyond the declared finance-report analysis purpose. These examples train routing behavior toward unrelated, potentially more sensitive tasks and can lead to overcollection or exfiltration of financial data.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill enables the exec tool but does not clearly warn users that command execution may occur. In an agent environment, hidden execution capability is dangerous because users may provide data believing the skill is documentation-only while the agent may run commands, install packages, or access the filesystem.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill describes API-based integration and data exchange but does not provide a clear privacy warning that user financial data may be transmitted to external services. Because the domain is financial analysis, transmitted inputs may contain highly sensitive holdings, statements, or company data, making undisclosed sharing especially risky.

Static analysis

No suspicious patterns detected.