Security audit

财务报告分析器

Security checks for vulnerabilities and agentic risk

Overview

This finance-reporting skill is not clearly harmful, but it asks for broad read/write/execute use on sensitive financial files without a concrete implementation or tight scope.

Review this skill carefully before installing. It does not show malicious behavior, exfiltration, persistence, or destructive actions, but it is too vague for sensitive financial workflows: ask the publisher for the actual script or implementation, supported input/output schema, credential/data-flow details, and command-safety boundaries before using it on private finance files.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill claims to analyze uploaded Excel/PDF financial files and generate interactive reports, but the document provides no concrete implementation, parser details, or constrained execution path to support those claims. In an agent context, this mismatch can mislead users or orchestration systems into invoking broad read/exec/write capabilities on sensitive finance documents without clear guarantees about what is actually performed.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The parameter section uses generic placeholders such as content, mode, and max_retries instead of finance-specific file paths, report options, or validation constraints. This ambiguity is dangerous because agents may map arbitrary user-controlled content into execution flows, increasing the risk of misuse, unexpected command construction, or processing of unintended sensitive data.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The response schema is a generic execution wrapper rather than a finance-analysis result structure, which contradicts the advertised specialized reporting behavior. While less directly exploitable than command injection, this can cause downstream agents or users to trust nonexistent analysis fields, mishandle outputs, or make decisions based on misleading success indicators instead of validated report content.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill description says to use it broadly for data analysis, report generation, statistical insights, and visualization, without clear trigger constraints or scope limits. In agent systems, overly broad invocation criteria can cause the skill to be selected for tasks beyond its safe or intended domain, exposing sensitive data to unnecessary read/exec/write operations and increasing the chance of unsafe autonomous behavior.

Natural-Language Policy Violations

Medium

Confidence: 78% confidence
Finding: The description states that Chinese interaction is supported/used without making language preference an explicit user choice. This is primarily a safety and usability issue: it can cause misinterpretation of financial inputs, outputs, or warnings if the user's preferred language differs, which is especially problematic in a finance context where precision matters.

Static analysis

No suspicious patterns detected.