financial-report-analysis

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:34 PM UTC
• Version:
  1.0.2

Overview

This skill is a disclosed financial-report analysis helper with local sample-data calculations, but users should not treat its simple ratings as real investment advice.

Install only if you want a local financial-report analysis helper. Treat the scoring, ratings, and recommendation text as heuristic commentary, not professional financial advice or a basis for trades. Verify any payment channel and publisher identity independently before paying, and review future versions carefully if they add real-time data APIs, caching, or credential-based integrations.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill’s stated purpose is financial-statement analysis, but the code assigns scores, ratings, and explicit investment recommendations such as whether the company is worth investing in. In a financial domain, this crosses from descriptive analytics into actionable advisory output, which can mislead users into making financial decisions based on a simplistic model and create compliance, safety, and trust risks.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The module-level description presents the skill as a financial-report analysis tool, but the implementation produces investment advice as part of the core report flow. This mismatch increases the risk that users or integrators will trust the skill as neutral analysis when it is actually making suitability-style judgments.

VirusTotal

59/59 vendors flagged this skill as clean.