金融知识问答

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:55 AM UTC
• Version: 1.0.0

Overview

This finance Q&A skill is documentation-only, but it asks for broad file and shell authority and promotes personalized investment advice without clear safeguards.

Review this skill carefully before installing. It does not contain executable code, but it requests more agent authority than its stated education purpose needs and could steer an agent into personalized financial advice or elevated troubleshooting. Use only with strict tool limits, avoid giving it trading credentials or private portfolio history unless truly necessary, and do not treat its outputs as professional investment advice.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:9

Finding

Excessive Filesystem and Shell Tool Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9–13
Vulnerability Type: Excessive tool permissions violating least privilege
Risk Level: Medium

Complete Code Snippet:

yaml

tools:
  - Read
  - Write
  - Edit
  - Bash

Technical Analysis

The skill declares unrestricted file-reading, file-modification, and shell-execution tools even though its documented purpose is financial education, question answering, and investment analysis. The documentation does not identify a concrete workflow that requires arbitrary local file modification or command execution.

Granting Write, Edit, and Bash substantially expands the skill's authority beyond its stated functional requirements. If untrusted financial content, market data, or user instructions influence the agent's behavior, these unnecessary capabilities could be used to modify local files or execute commands. The actual exploitability and accessible paths depend on the host agent's sandbox and permission enforcement.

Attack Path

1. The skill is loaded with Read, Write, Edit, and Bash available.
2. The user supplies untrusted content, or the agent processes attacker-controlled financial data.
3. Malicious instructions embedded in that content influence the agent's workflow.
4. The agent invokes an unnecessarily authorized file-modification or shell tool.
5. Commands execute or files are changed within the host agent's effective permission boundary.

Impact Assessment

Successful exploitation could provide the attacker with the same local filesystem and command-execution scope granted to the agent process. Potential consequences include modification or deletion of accessible files, execution of local programs, exposure of readable information, and interference with other project resources.

This declaration does not itself prove command execution or malicious intent. However, it creates an avoidable privilege bound ...[truncated 74 chars]

Remediation

View remediation

Remediation Suggestions

• Remove Write, Edit, and Bash from the declared tools.
• Remove Read as well unless a documented workflow genuinely requires access to local files.
• Use narrowly scoped, allowlisted market-data APIs instead of general shell commands.
• If file access becomes necessary, restrict it to a dedicated application-owned directory.
• Require explicit user confirmation before any filesystem mutation.
• Enforce command and path allowlists at the host-agent level rather than relying only on skill instructions.
• Document each retained tool, the operations it may perform, and the minimum resources it may access.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:386

Finding

Unsafe Recommendation to Retry Operations with Administrator Privileges

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 386; duplicated at lines 405, 420, and 435
Vulnerability Type: Unjustified privilege-elevation guidance
Risk Level: Medium

Complete Code Snippet:

text

| Insufficient permissions | The current user lacks read/write permission | Check file permissions and run as administrator |

The snippet above is an English translation of the repeated troubleshooting row in the source.

Technical Analysis

The troubleshooting guidance recommends running an operation as an administrator whenever the current user lacks file read or write permissions. The skill does not define an installation, maintenance, or runtime operation that legitimately requires administrator privileges.

Elevation is presented as a generic workaround rather than a last resort following validation of the target path, ownership, requested operation, and minimum required permissions. This can cause an otherwise limited operation to inherit system-wide privileges. The recommendation is repeated in four troubleshooting sections, increasing the likelihood that a user or agent will follow it.

Attack Path

1. A file operation fails because the current process lacks access to a path.
2. The troubleshooting instructions recommend retrying with administrator privileges.
3. The user or agent elevates an unspecified operation without first validating its safety.
4. Malicious input, an unsafe command, or an incorrect path is processed with elevated authority.
5. The operation affects resources that were protected from the original unprivileged process.

Impact Assessment

If followed, the guidance may allow an operation to obtain administrator-level access on the affected host. Depending on the command and operating system, this could enable modification of protected files, access to other users' data, changes to system configuration, or execution of programs with elevated privileges.

...[truncated 242 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the recommendation to run operations as an administrator.
• Diagnose the exact path, ownership, access mode, and required operation before changing permissions.
• Use an application-owned working directory with narrowly scoped read or write access.
• Grant permission only to the specific file or directory required by the documented workflow.
• Never elevate operations whose command, arguments, or paths are influenced by untrusted input.
• Require explicit user review and confirmation if a genuinely necessary administrative operation is introduced.
• Consolidate the duplicated troubleshooting sections so corrected guidance is maintained in one location.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill requests Read, Write, Edit, and Bash even though the described purpose is financial knowledge Q&A. Granting broad filesystem and shell access to a skill without a clear operational need violates least privilege and creates a pathway for arbitrary file access, data modification, or command execution if the skill is triggered unexpectedly or repurposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill promotes personalized investment advice based on user risk preference and historical trading data, but it does not provide clear warnings that outputs may be inaccurate, non-fiduciary, or unsuitable as sole decision support. In a financial context, this is especially dangerous because users may rely on the advice for real trading decisions, leading to material losses or compliance issues.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation text says to use the skill whenever the user needs finance-related Q&A functionality, which is broad enough to match many generic finance requests. Overbroad activation increases the chance the skill is invoked in contexts involving regulated advice, portfolio decisions, or operational actions beyond its safe and intended use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document expands from educational Q&A into simulated trading, backtesting, market visualization, and risk tooling, materially broadening the skill’s functional scope. This can lead to unsafe activation, over-trust by users, and use of the skill for higher-risk financial actions without appropriate controls, disclaimers, or implementation boundaries.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill presents itself as a documentation-style financial Q&A capability, yet later content references command execution, file operations, and administrator-level troubleshooting. This mismatch can cause an agent or user to grant or invoke execution-capable behavior that is outside the declared scope, increasing the chance of unsafe tool use or privilege misuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.