财务

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:57 AM UTC
• Version: 1.0.0

Overview

This finance skill appears non-malicious, but it asks for broad file and command authority while describing generic and unrelated capabilities beyond finance analysis.

Review this skill before installing. It may be reasonable for finance report generation to read user-provided data or call market-data APIs, but this package asks for broader local file and command powers than it explains. Only use it in a sandboxed environment and avoid granting write or command execution unless you explicitly need and approve each action.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:19

Finding

Excessive Filesystem and Command-Execution Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:19-22
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Medium

Vulnerable Code

yaml

tools:
- read
- exec
- write

The declared capabilities are also described in SKILL.md:247-249 as supporting file reading and writing and system-command execution.

Technical Analysis

The Skill declares unrestricted read, write, and exec capabilities even though its stated purpose is analysis of stock and cryptocurrency market data. The package contains only SKILL.md and provides no implementation demonstrating that unrestricted local filesystem access or shell execution is necessary.

No path restrictions, command allowlist, argument validation, execution policy, or enforceable sandbox configuration is supplied. Consequently, a host that grants the declared tools could expose substantially more authority than is required for market-data analysis. This violates the principle of least privilege and enlarges the impact of malicious, compromised, or untrusted instructions processed while the Skill is active.

The declaration alone does not prove that commands are automatically executed or that permissions are granted by every host. Exploitation depends on the host agent honoring these tool declarations and allowing their use without adequate approval or isolation.

Attack Path

1. A user or host agent activates the Skill for a financial-analysis task.
2. The host grants the declared read, write, and exec tools.
3. Malicious or untrusted task content induces the agent to use those tools for operations unrelated to financial analysis.
4. The agent reads unrelated local files, modifies accessible data, or runs an attacker-selected command.
5. The resulting access occurs with the filesystem permissions and operating-system privileges of the host agent process.

Impact Assessment

If the host grant ...[truncated 600 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec and write unless they are demonstrably required for the Skill's core financial-analysis functionality.
2. Prefer a narrowly scoped network or market-data API tool rather than general-purpose shell execution.
3. Restrict reads to files explicitly selected or supplied by the user.
4. If export functionality requires writing, confine writes to a dedicated output directory and reject absolute paths, traversal sequences, symbolic-link escapes, and overwriting of existing files by default.
5. If command execution is unavoidable, use fixed executable paths and structured argument arrays rather than shell command strings.
6. Enforce executable and subcommand allowlists, strict ticker and option validation, resource limits, and a deny-by-default environment.
7. Require explicit user confirmation before filesystem modification or command execution.
8. Supply and audit the actual implementation so reviewers can verify input validation, sandbox boundaries, and command construction.
9. Document the exact permissions needed and ensure the host grants no broader access than those documented permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation text is broad and mixes finance requests with generic data analysis, reporting, statistics, and visualization language. Overly broad routing criteria can cause the skill to trigger on many common prompts, exposing users to unintended tool use or side effects from a skill whose behavior and scope are not tightly constrained.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The typical scenarios include a cryptography/encryption use case that does not fit the stated finance-analysis purpose. Such capability drift is dangerous because it broadens the apparent authority of the skill and may encourage invocation for unrelated sensitive operations that involve secrets or data transformation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is presented as a finance-analysis capability, but later describes generic file processing, API integration, and command execution. This mismatch can cause an agent or user to invoke the skill in broader contexts than intended, increasing the chance of unintended filesystem changes, external data transmission, or shell execution under a misleading finance label.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markdown advertises file writing, external API usage, and command execution, but does not provide clear upfront warnings or consent gates about system and data impact. In an agent environment, these are high-risk capabilities because they can alter local state, leak sensitive information to external endpoints, or run unsafe commands if the skill is selected unexpectedly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.