财务

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:50 AM UTC
• Version: 1.0.2

Overview

This finance skill is not clearly malicious, but it asks for broad read, write, and command execution authority without enough finance-specific limits.

Review this skill carefully before installing. It may be acceptable in a tightly sandboxed agent, but grant it only the minimum tools needed for finance data lookup, avoid exposing sensitive files or environment secrets, and require confirmation before any file write or command execution.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:23

Finding

Excessive and Underspecified Tool Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-26
Vulnerability Type: Excessive tool permissions violating least-privilege principles
Risk Level: Medium

yaml

tools:
- read
- exec
- write

Technical Analysis

The skill declares general-purpose file-reading, file-writing, and command-execution capabilities. Its stated purpose is financial market-data retrieval and analysis, which does not inherently require unrestricted access to local files or arbitrary system commands.

The document does not define path restrictions, a command allowlist, cache-directory boundaries, shell-input validation, user-approval requirements, or an enforceable sandbox policy. In particular, the exec permission is not justified by a concrete financial-data operation. If the hosting agent grants these tools according to the manifest, the skill receives capabilities beyond its documented functional requirements.

The project contains no executable scripts and no explicit malicious command. Exploitation therefore depends on the hosting agent exposing the declared tools and on attacker-controlled prompts or untrusted external content influencing tool use.

Attack Path

1. A user or platform loads the skill and grants the declared read, write, and exec tools.
2. An attacker supplies a crafted financial request, or untrusted provider content introduces instructions that influence the agent.
3. The agent interprets those instructions as requiring local file access or command execution.
4. Because the skill defines no path, command, or argument restrictions, the agent may read unrelated files, modify local data, or execute commands outside the legitimate market-data workflow.
5. The resulting access can affect confidentiality or integrity within the permissions and sandbox boundaries of the hosting agent.

Impact Assessment

Successful exploitation could permit:

• Reading files accessible to the agen ...[truncated 635 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec unless a specific, documented operation strictly requires command execution.
2. Replace general-purpose tools with narrowly scoped financial-data API tools where the platform supports them.
3. If caching is required, restrict read and write to a dedicated cache directory and prevent path traversal, symlink escapes, and access to unrelated files.
4. Define approved data providers, destination domains, request methods, timeouts, response-size limits, and provider-fallback behavior.
5. Validate financial symbols and intervals against strict allowlists before using them in file paths, URLs, or command arguments.
6. Prohibit direct shell interpolation of user-controlled or provider-controlled values. If command execution is unavoidable, use fixed executables and structured argument arrays.
7. Require explicit user confirmation before exceptional file operations or system-command execution.
8. Document and enforce sandbox boundaries, minimum filesystem permissions, and denial of access to credentials, environment secrets, and system directories.
9. Add tests confirming that financial requests cannot trigger unrelated file access or arbitrary command execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation description is broad and vague, encouraging invocation whenever a user has 'finance-related' needs without tightly scoping permitted actions. In a skill that advertises read, write, and exec capabilities, ambiguous triggering increases the risk that an agent applies the skill to sensitive or unintended tasks and performs side-effecting actions without clear necessity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description explicitly says '支持中文交互' and presents the skill as providing Chinese interaction, but it does not offer the user a language choice or indicate that other languages are supported on request. This can violate language/locale policy when a skill appears to force a specific language without opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented output schema does not match the skill’s stated finance-tracking purpose and instead presents a code-audit scoring report. This can mislead an agent into producing or trusting unrelated structured data, increasing the chance of unsafe downstream automation, incorrect decisions, or misuse of the skill in contexts that expect financial data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill describes file handling, API integration, and command execution as capabilities but does not provide explicit user-facing guardrails about what may be modified, what external calls may occur, or when consent is required. Because the skill also lists write and exec tools, this weak specification can enable over-privileged behavior, unexpected filesystem changes, or unreviewed command/API execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.