金融素养学习工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.3

Overview

This looks like a financial-literacy education skill, but it asks for shell and file-access authority and describes broad automation features that do not fit that purpose.

Review carefully before installing. The educational finance content itself is ordinary, but the skill requests file reading and command execution and contains generic automation/API/file-operation claims. Install only in a tightly sandboxed environment or after those permissions and unrelated capability claims are removed; do not treat its outputs as personalized financial, tax, or legal advice.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Excessive Tool Permissions Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5-18
Vulnerability Type: Excessive local file access and command-execution permissions
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: read exec
compatibility: "Requires LLM with tool-use capability"
metadata:
  displayName: "金融素养学习工具"
  version: "1.0.0"
  summary: "个人金融素养教育工具，提供基础金融概念、理财入门与风险意识培养。"
  tags:
    - "Finance"
    - "金融教育"
    - "理财入门"
  source: "SkillHub"
  converted_at: "2026-07-22T17:58:36"
tools:
  - exec
  - read

The broader operational claims appear at SKILL.md:301-303 and are duplicated at SKILL.md:309-311:

markdown

- **文件处理**: 支持多种文件格式的读取、解析和写入操作
- **API集成**: 通过标准化接口调用外部服务并处理响应
- **命令执行**: 在安全沙箱中执行系统命令并收集结果

A command-execution use case also appears at SKILL.md:267:

markdown

| 网络错误 | 连接超时或不可达 | 执行ping命令测试网络连通性,检查防火墙和代理设置连接后执行ping命令测试网络连通性,检查防火墙和代理设置连接后重新执行命令，参考国内替代方案 |

Technical Analysis

The skill is presented as a pure Markdown financial-literacy knowledge base that does not require external data access, yet its manifest grants both local file-reading and general command-execution capabilities. Static educational explanations and quizzes do not legitimately require these privileges.

Granting read and exec expands the skill's authority beyond its documented purpose. The generic claims that it can process files, integrate external APIs, and execute system commands do not define an allowlist, fixed arguments, path restrictions, network restrictions, or an approval boundary. Merely stating that commands should execute in a sandbox does not establish or enforce such isolation.

This is a least-privilege violation rather than evidence of an embedded malicious payload. The audited package contains only SKILL.md; no scripts, binaries, dependency manifests, credential-harvesting logic, persistence mechanisms, or remote payload retrieval implementation were identif ...[truncated 1795 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec and read from both allowed-tools and tools; the documented educational functionality should operate without system tools.
2. Delete the generic file-processing, API-integration, command-execution, and ping instructions unless they are essential to a clearly documented feature.
3. If diagnostics are genuinely necessary, replace unrestricted exec with a dedicated diagnostic tool that:
   • Accepts only fixed operations.
   • Validates destinations against an explicit allowlist.
   • Rejects shell metacharacters and arbitrary arguments.
   • Enforces timeouts and output-size limits.
   • Runs without shell interpretation and with minimal operating-system privileges.
   • Requires explicit user approval before execution.
4. Restrict file access to explicitly approved paths and read-only operations. Do not expose general filesystem reads to a static educational skill.
5. Enforce network egress restrictions and document every permitted destination if external API access is later introduced.
6. Make the capability documentation consistent with the implementation. A pure Markdown knowledge base should not claim unsupported file writing, API integration, or command execution.
7. Add automated manifest checks that reject permissions not directly required by documented features.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file states that the skill is a pure Markdown knowledge-base tool with no external data use and no API key requirements, yet elsewhere advertises API integration, command execution, file handling, and network troubleshooting behavior. These contradictions undermine trust boundaries and can mislead an orchestrator or user into approving a skill that may perform actions far beyond passive educational content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is presented as a simple financial-literacy education tool, but later claims broad automation features including file processing, API integration, information retrieval, and system command execution. This capability mismatch can cause an agent to grant or invoke dangerous powers under a benign-looking label, increasing the risk of privilege misuse, user deception, and unintended command or network activity.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description says the skill should be used 'when 用户需要financial-literacy-tool-free相关功能时使用', which is effectively a catch-all invocation condition rather than a specific trigger. It does not define clear activation phrases, scope boundaries, or negative examples beyond excluding '复杂需求', making unintended invocation more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description states '支持中文交互', and the file consistently frames operation in Chinese without offering an explicit language choice or opt-in. Under the policy, constraining language or locale without user choice or a clearly justified regional requirement is a violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Declaring the exec tool for a beginner financial-literacy education skill violates least privilege because the stated use case does not require shell access. Even without explicit malicious commands, unnecessary execution capability materially increases the blast radius if the skill is invoked with adversarial prompts or if later instructions are expanded.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown skill provides guidance on savings, investing, insurance, and budgeting, which can affect user finances, but the main description does not prominently warn that outputs are educational and should not be treated as professional or personalized financial advice. Later limitations exist, but the warning is not surfaced where users first learn what the skill does and see actionable examples.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The capability coverage section expands the trigger surface with inconsistent keywords such as data analysis, report generation, statistics, visualization, automation workflows, and other scenarios unrelated to financial-literacy education. In context, this is dangerous because the broad scope can cause the skill to be selected for tasks where its unnecessary exec/network-style capabilities may be exposed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Claims of external API integration and network-oriented operation are not justified by a basic financial-literacy teaching function. Unnecessary network and integration capabilities increase the chance of data exfiltration, remote content injection, or expansion of the skill into a general-purpose action surface under an innocuous name.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The sample configuration sets 'language: zh-CN' as the only illustrated locale and does not say users may choose a different language. This reinforces a fixed-language constraint rather than an opt-in or configurable locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.