Security audit

金融数据终端

Security checks for vulnerabilities and agentic risk

Overview

This finance analysis skill is not directly malicious, but its documentation expands into account access and transaction submission without clear scoping or user-control warnings.

Review this before installing as a high-impact finance skill, not just a reporting helper. Only use it with least-privilege, read-only credentials unless you intentionally want account access, alerts, or transaction capability, and require explicit confirmation for any account-linked or money-moving action.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill is presented as a financial data analysis/reporting terminal, but the embedded examples include account access, transaction history retrieval, and transaction submission. This scope expansion is dangerous because users or agents may authorize the skill under a low-risk analytics assumption while it actually exposes state-changing financial operations.

Description-Behavior Mismatch

Medium

Confidence: 78% confidence
Finding: The documentation advertises portfolio optimization and strategy recommendation features that go beyond the manifest's stated data analysis/reporting scope. Even if not directly executable here, overstated capabilities can cause unsafe trust decisions, accidental invocation, or improper delegation of investment-sensitive tasks.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Transaction execution is a materially different and higher-risk capability than financial analysis. In a skill framed as an analytics terminal, including transaction-sending functionality can enable unauthorized or insufficiently reviewed financial actions with direct monetary consequences.

Context-Inappropriate Capability

Medium

Confidence: 83% confidence
Finding: Account-management and alerting functions are not clearly justified by the manifest's stated analytics/reporting purpose. These features broaden data access and operational reach, increasing privacy and abuse risk if invoked under the assumption that the skill is read-only or analysis-only.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The invocation language is broad enough to match generic data-analysis, reporting, and visualization requests, which can cause over-triggering. In this skill, that is more dangerous because the toolset includes exec and the documentation also introduces account and transaction-adjacent capabilities, increasing the chance of activating a higher-risk skill for low-risk user intent.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill exposes read and exec tools and documents API keys, file handling, and network/API use without a clear, prominent user-facing warning about privacy, credential, and system-impact risks. This is dangerous because users may treat it as a harmless analysis skill while it can access sensitive data, execute commands, and interact with external services.

Static analysis

No suspicious patterns detected.