Security audit

A股财务建模助手

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed A-share financial modeling guide with no executable code, persistence, credential handling, or hidden behavior found.

Installers should understand that this skill may cause the agent to ask for company and financial modeling assumptions and to use market or financial data sources. Confirm the data sources and assumptions before relying on any valuation output, especially for investment decisions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrases are broad, high-frequency finance terms such as 'DCF估值' and '建财务模型', which can activate the skill for many ordinary conversations without clear scoping. Over-broad activation can cause unintended skill invocation, leading the agent to apply domain-specific workflows, request sensitive financial inputs, or override user intent in contexts where the skill was not actually desired.

Vague Triggers

Low

Confidence: 89% confidence
Finding: The use of an open-ended trigger description with '等' makes activation boundaries ambiguous and effectively expands scope beyond the listed examples. This increases the chance of accidental invocation and reduces predictability of when the skill takes control, which is a security and safety concern for agent routing.

Static analysis

No suspicious patterns detected.