Security audit

财报分析入门工具

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a local finance-report helper, but its instructions mix sensitive financial-file handling with broad command, API, network, and information-retrieval claims that are not clearly scoped.

Review this skill before installing. Use it only on financial files you are comfortable processing in the agent environment, keep outputs in a private directory, delete generated HTML reports when no longer needed, and do not allow API/network use unless you have confirmed exactly what data will be sent and where.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill claims that all data processing is performed locally and that no API key is required, but elsewhere advertises API integration and network communication behavior. This inconsistency can mislead users into exposing sensitive financial documents under a false expectation of offline-only handling, weakening informed consent and trust boundaries.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill is presented as a narrow local finance-report generator, yet the documentation expands its capabilities to include external API integration, information retrieval, and generic command execution. That scope mismatch increases attack surface and may cause the agent to authorize broader behaviors than the user intended, including data exfiltration or execution of unsafe commands unrelated to report generation.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: References to external API calls and network communication are not justified by the stated purpose of analyzing local financial files and generating local HTML reports. Unnecessary network-capable behavior creates avoidable risk of transmitting sensitive corporate or investor data beyond the local environment.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation language is broad enough to overlap with common data-analysis and reporting requests, which raises the chance that the skill will be invoked in situations beyond its intended constraints. Over-broad triggering can route unrelated tasks into a skill with exec permissions, creating unnecessary exposure to file and command execution behaviors.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The example triggers are generic everyday requests like analyzing a report or visualizing data, without clear safeguards on file type, locality, or permitted actions. This can cause over-selection of the skill and unintentionally grant execution capability for tasks that should be handled by a less-privileged workflow.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The skill generates and stores local HTML reports derived from potentially sensitive financial documents, but does not provide an upfront warning about confidentiality, file retention, or browser exposure risks. Users may unknowingly create persistent artifacts containing sensitive business data in shared directories or systems.

Static analysis

No suspicious patterns detected.