Cfo Advisor

Security checks across malware telemetry and agentic risk

Overview

This is a CFO advisory prompt-only skill that is broadly finance-focused but does not include hidden code, persistence, credentials, or data exfiltration behavior.

Install it as advisory financial guidance, not as a complete calculator package. Keep company-context.md limited to information you are comfortable letting the agent use, and verify any referenced scripts or financial models separately before relying on them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation criteria are broad enough that ordinary mentions of common finance terms could trigger the skill without strong relevance checks. Over-broad activation can cause inappropriate context loading, unnecessary access to sensitive financial files like company-context.md, and misrouting of user requests into a high-trust financial workflow.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal