Security audit

估值建模专家

Security checks for vulnerabilities and agentic risk

Overview

The skill is a financial valuation assistant, but it requests broad command execution and discusses file writes without clear limits or user controls.

Review before installing. Use it only in an environment where command execution is sandboxed, provide only least-privilege financial data API keys, and avoid giving it sensitive local files or credentials unless you explicitly requested that workflow.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The skill claims there is no eval/exec or untrusted command execution, yet elsewhere it explicitly advertises command-execution capability. This creates a dangerous trust mismatch: operators may relax scrutiny based on the safety claims while the skill still enables powerful actions that could execute harmful commands or process adversarial inputs.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The document says risky code was removed and security was enhanced, but later sections reintroduce risky behaviors such as file handling, API access, and command execution. This inconsistency can mislead users and reviewers into trusting a skill that still exposes meaningful attack surface.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: Command execution is not necessary for a valuation-model skill whose primary purpose is financial analysis and structured output. Unneeded exec capability expands the attack surface substantially, enabling shell abuse, environment inspection, unintended network access via local tools, or destructive actions if the agent is induced to run commands.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Advertising file write capability for a valuation-analysis skill is broader than necessary and can lead to unauthorized file creation, overwrite, or persistence of sensitive outputs. In an agent context, even benign reporting features can become dangerous if users are not clearly warned about modifications to local data.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill describes file-writing behavior without a clear warning that user data or files may be created or modified. Lack of transparent disclosure increases the risk of accidental overwrite, data leakage into generated artifacts, or persistence of sensitive financial information.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill advertises command execution without a clear warning or consent flow. In an agent environment, hidden or under-disclosed execution capability can be abused through prompt injection or user confusion to run unsafe local commands.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: Quick-start instructions tell users to check output files but do not explain whether files are newly created, where they are written, or whether existing files may be overwritten. This is a weaker issue, but it still creates avoidable risk of accidental data modification or disclosure.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The repeated promotion of command-execution capability without prominent warning normalizes a high-risk feature in a low-necessity context. Repetition increases the chance that users or orchestrators treat exec as routine, reducing caution around a capability that can materially affect the host environment.

Static analysis

No suspicious patterns detected.