Security audit

Macro Monitor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed daily macro-data monitor that browses public finance sources and sends the user a report, with some setup and scoping caveats but no evidence of malicious behavior.

Install this only if you want a scheduled daily agent task that visits public macroeconomic and financial-news websites and sends you a report. Review or disable the cron schedule if you do not want unattended runs, and check notification behavior plus any local references/indicators.md updates before relying on it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill claims risk code was removed and safety improved, yet it still declares exec capability and explicitly suggests modifying a local reference file. This mismatch can mislead users and reviewers about the actual trust boundary, and the local knowledge-base update behavior introduces an integrity risk because future runs may consume attacker-influenced content.

Intent-Code Divergence

Low

Confidence: 83% confidence
Finding: The workflow instructs use of browser and message tools that are not declared in the manifest tools list, while separately emphasizing exec-based operation. This capability mismatch weakens reviewability and can cause the skill to run with undeclared outbound browsing or messaging behaviors, reducing transparency and making abuse or accidental overreach harder to detect.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The manual trigger phrase is broad and action-oriented, so normal conversation about macro monitoring could unintentionally activate automated browsing and message-push behavior. Because the skill performs outbound actions and scheduled data collection, accidental triggering increases the chance of unreviewed network access and unsolicited notifications.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The listed trigger keywords include generic terms like trading, monitor, 数据源, and fred without tight scoping, which raises the likelihood of incidental activation in unrelated contexts. In this skill, unintended activation is more concerning because it leads to autonomous browsing of multiple external sites and possible user messaging.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The description advertises automatic browsing of external sources and pushing messages to users without a clear user-facing disclosure that outbound network and notification actions will occur. This creates a consent and transparency problem, especially for a scheduled skill that may operate unattended and contact third-party sites regularly.

Static analysis

No suspicious patterns detected.