Security audit

财报分析专业版

Security checks for vulnerabilities and agentic risk

Overview

This finance-report skill is mostly aligned with its purpose, but it asks for broad read/write/command authority while giving inconsistent guidance about local-only processing versus external API or network use.

Review before installing. Only use this skill on financial files and output directories you explicitly choose, and do not allow network callbacks or external API use unless the publisher clarifies exactly what data is sent and where. Treat command execution as requiring confirmation, especially for batch jobs and generated shell commands.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The documentation states that all processing is completed locally, yet elsewhere the skill advertises external API integration and HTTPS network communication. This inconsistency can mislead users and agents about the trust boundary, causing sensitive financial documents to be handled under false assumptions about data locality and network exposure.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill declares generic external-service API integration as a core capability without tying it to a specific finance-analysis need or constraining what services may be contacted. In an agent setting, broad API capability increases the chance of unnecessary data exfiltration, unauthorized outbound requests, or expansion of the skill beyond its declared purpose.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill lists command execution as a core capability even though the user-facing purpose is financial report analysis. In a toolset that already includes exec, broad command execution materially raises the risk of shell misuse, unsafe parameter passing, filesystem damage, or execution of attacker-influenced commands through natural-language triggering.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation guidance says to use the skill for broad needs like data analysis, report generation, statistical insight, and visualization, which can cause over-triggering far outside narrowly intended finance-report tasks. Overbroad invocation is especially risky because the skill also advertises file processing, writing, and command execution, increasing the chance of unnecessary privileged actions on unrelated user requests.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The documentation says natural-language instructions can trigger the skill without defining constrained trigger phrases, safety gates, or exclusions. In agent environments, unconstrained NL triggering can route ambiguous prompts into a skill with read/write/exec privileges, leading to accidental execution on sensitive files or unintended workflows.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill describes batch processing, exports, OCR, and command execution but does not prominently warn that it will read local files, write outputs, and invoke commands. Users may consent to analysis without realizing the operational impact on their filesystem or execution environment, which is significant for a finance-oriented skill handling potentially sensitive documents.

Static analysis

No suspicious patterns detected.