Security audit

估值建模专家

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a valuation-analysis guide, but it asks for command execution and describes broad file/API automation without clear limits or user consent boundaries.

Review before installing. Use it only for valuation tasks with financial inputs you intend to share, and avoid letting it run shell commands or process local files unless you explicitly asked for that action and understand what data and paths are involved.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill explicitly advertises command execution capability even though its stated purpose is valuation modeling. In an agent environment, unnecessary exec access expands the attack surface significantly: prompt injection or misuse could trigger arbitrary shell commands, enabling data exfiltration, environment inspection, or lateral actions unrelated to finance analysis.

Context-Inappropriate Capability

Low

Confidence: 82% confidence
Finding: The documentation broadens the skill into generic file processing/writing behavior that is not necessary for a bounded valuation-analysis tool. Unneeded file capabilities increase the chance that the skill is invoked for unrelated tasks, which can lead to unauthorized file creation, overwrite, or handling of sensitive local data.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill claims in its security section that there is no dangerous exec usage, while elsewhere it advertises command execution capability. This contradiction is dangerous because it can mislead reviewers and downstream users into trusting a broader privilege set than is actually safe, weakening scrutiny around high-risk tool use.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest presents a bounded valuation-modeling skill, but the body expands it into a generic automation skill covering file handling, API integration, command execution, and information retrieval. This mismatch increases the risk of overbroad activation and privilege use, making the skill more susceptible to abuse outside its intended financial-analysis context.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation description is overly broad, effectively saying to use the skill whenever the user needs valuation-related help. Broad triggers increase the chance the agent will invoke a higher-privilege skill in ordinary conversation, which becomes more dangerous here because the skill also exposes exec and broad automation behaviors.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The document advertises file processing, external API access, and command execution without clear user-facing risk disclosure or consent boundaries. In practice, this can cause users to underestimate that local files, network requests, or shell actions may occur, undermining informed consent and increasing the chance of unsafe or unintended operations.

Static analysis

No suspicious patterns detected.