Security audit

财务

Security checks for vulnerabilities and agentic risk

Overview

This finance skill does not show destructive or exfiltration behavior, but it asks for broad read, write, and command execution authority while describing generic automation beyond finance analysis.

Review this skill carefully before installing. It may be acceptable for a controlled finance-analysis workflow, but grant it access only where read/write/command execution is expected, and require explicit user confirmation for file changes, shell commands, API calls, and any use of API keys.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is presented as a finance-analysis tool, but its documented scenarios include unrelated cryptographic operations, file processing, and generalized execution behavior. This scope inflation can mislead an agent into invoking broader capabilities than the user expected, increasing the chance of unsafe file or command actions under a trusted finance label.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: Later sections explicitly recast the skill as a generic automation utility with file handling, API integration, and command execution, which materially exceeds its claimed Yahoo Finance purpose. In an agent ecosystem, this mismatch is dangerous because users or orchestrators may grant trust based on the benign finance branding while the skill encourages broad side-effecting operations.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The feature tables and embedded text describe a generic automation framework rather than a bounded finance skill, creating deceptive affordances about what actions are appropriate. This increases the risk of overbroad invocation and unsafe agent behavior because operators cannot reliably infer the real security boundary from the skill's label.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation guidance says to use the skill whenever the user needs 'finance-related' functionality, and elsewhere expands into data analysis, reporting, visualization, and automation. Such broad routing criteria can cause the agent to select this skill for loosely related or generic tasks, unintentionally exposing exec/write capabilities in contexts where they are unnecessary.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The markdown advertises file writing, external API use, and command execution, but does not provide prominent user-facing warnings, consent requirements, or safety boundaries for these side-effecting operations. In practice, this can normalize dangerous behavior and lead agents to perform filesystem or shell actions under ambiguous authorization.

Static analysis

No suspicious patterns detected.