Security audit

Fund Advisor

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only fund-advisor skill whose storage, report generation, knowledge-base, and Feishu notification behavior is disclosed and aligned with its stated purpose, though users should treat financial data carefully.

Install only if you are comfortable with user-provided investment preferences, diary entries, alerts, and generated reports being stored or sent through the configured services. Avoid entering brokerage credentials, bank credentials, account numbers, or highly sensitive personal details; verify S3, Feishu, knowledge-base, retention, deletion, and access-control settings before real use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The document recommends persisting user preferences to local files under /tmp/user_profiles using a user ID, which expands the agent’s behavior into profile storage beyond the stated advisory scope. In a fund-advisory context, saved preferences can include sensitive financial suitability data, creating privacy, retention, and access-control risks if stored without explicit consent, minimization, and protection.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The documented `add_fund_knowledge_batch` tool allows the agent to write arbitrary caller-supplied text into a persistent knowledge base without showing any scope restriction, approval gate, or content validation. In a fund-advisor skill, persistent knowledge ingestion is higher risk because poisoned or sensitive content can alter future retrievals, leak retained data, or create durable prompt-injection material across sessions.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The `check_file_access` example claims to enforce permissions but only checks whether `user_id` appears anywhere in the file path, which is not a real authorization control. An attacker can craft paths containing that substring or exploit naming collisions to bypass the check and access or manipulate another user's files.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill explicitly documents storing user profiles, investment diaries, notification settings, and alerts under /tmp and uploading reports to S3, but does not warn users about retention, access controls, encryption, or the sensitivity of financial data. In a financial-advisor context, this can expose highly sensitive personal and investment information through insecure temporary storage, shared-host leakage, accidental persistence, or uncontrolled cloud upload.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill supports Feishu webhook notifications and market alert pushes without clearly warning users that content may be transmitted to an external messaging platform. In this context, portfolio details, reminders, and alerts could disclose sensitive financial activity or personal data to third-party systems or misconfigured webhook endpoints.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The examples instruct the agent to generate a PDF report and return a download link without clearly warning that a persistent user document will be created. In a financial-advisory context, reports may contain sensitive portfolio and risk-profile data, so silent document creation can cause unintended storage or sharing of personal financial information.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The examples describe creating an investment diary from user reflections without warning that the content will be stored. Because these reflections may reveal financial behavior, risk tolerance, and personal circumstances, undisclosed persistence creates privacy risk and can lead to collection of sensitive personal data without informed consent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The examples describe setting Feishu alerts without warning that notifications will be sent through an external third-party service. In this skill context, alerts may expose investment interests, holdings, or market-monitoring preferences to external systems, so lack of disclosure can result in unintended data sharing and privacy leakage.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The storage overview states that user data is persisted in the filesystem, reports are stored in S3, and knowledge is stored durably, but it provides no user-facing disclosure or consent guidance. For a financial advisory skill handling sensitive profile and diary data, silent persistence increases privacy, compliance, and trust risks because users may reasonably assume the interaction is transient.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The examples store and later retrieve user investment profiles and diary entries, which are sensitive financial and behavioral data, without any explicit warning that the information will be persisted. In this skill context, that omission is more dangerous because users may disclose highly personal financial preferences and reflections that are then retained on disk unexpectedly.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The report-generation flow says PDFs are automatically uploaded to S3 and returned via downloadable links, but it omits a warning that report contents leave the local context and become accessible through a shareable URL for a period of time. Because the reports can contain financial profile and allocation details, this increases the risk of unintended disclosure through link sharing, logging, or bucket misconfiguration.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document-generation guidance explicitly states that generated reports are uploaded to S3 and returned as downloadable pre-signed URLs, but it omits any warning about handling sensitive portfolio or investor data in third-party storage. In a fund advisory context, reports may contain personal financial information, so silent external storage and link sharing creates confidentiality and retention risks if links are forwarded, logged, or generated for inappropriate content.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The Feishu integration retrieves a webhook credential and sends message content to an external messaging platform without warning users that investment alerts or report links leave the local agent boundary. In a financial advisory skill, outbound notifications can expose market positions, portfolio status, or report URLs to external systems, making this more sensitive than a generic chat notification example.

Ssd 3

Medium

Confidence: 83% confidence
Finding: The summarization example feeds old_messages directly into a prompt, which may include all prior user content verbatim. In a financial advisory agent, historical messages can contain sensitive personal and financial details, so indiscriminate forwarding increases exposure to downstream models and broadens the privacy surface without minimization or redaction.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The logging example records raw tool parameters and slices of tool results, which can capture user financial details, identifiers, or other sensitive content. Logs are often widely accessible and retained longer than operational data, so this creates a realistic confidentiality risk in the context of a fund-advisory agent.

Static analysis

No suspicious patterns detected.