Security audit

金融知识问答

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it asks for broad agent powers while expanding a financial education tool into sensitive investment-advice and data-handling workflows.

Review before installing. Use this only for educational finance explanations unless you explicitly trust it with broader local tool access. Do not provide brokerage credentials, account secrets, or unnecessary personal trading history, and avoid relying on it for actual investment decisions.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The skill claims security hardening and removal of sensitive-information leakage paths, yet still instructs use of external financial APIs and environment-stored API keys. This mismatch can create misplaced trust, leading users to expose credentials or assume stronger isolation than actually exists.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is framed as educational financial Q&A but its documented scope expands into personalized investment advice, backtesting, simulated trading, and risk modeling. This scope drift increases the chance that users provide sensitive financial data or rely on the skill for regulated or high-risk decision support without appropriate warnings, controls, or validation.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Granting Bash capability to a primarily documentation-centric financial Q&A skill is unnecessary and expands the attack surface significantly. Combined with troubleshooting guidance for files, permissions, commands, and network issues, it increases the likelihood of unintended command execution, local file access, or data exposure if the skill is invoked in an agentic environment.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation condition is broad enough to trigger on ordinary finance-related requests, which can cause the skill to engage outside its safest intended scope. In an agent system, over-broad routing can expose unnecessary tools or lead users into workflows involving sensitive financial data without clear opt-in.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill discusses user profiling, historical trading data, and personalized investment suggestions without a clear warning about sensitive financial data handling. This omission can cause users to share account, portfolio, or behavioral data without understanding privacy, security, and regulatory implications.

Static analysis

No suspicious patterns detected.