Wangdongjie Cfo Skill

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:44 PM UTC
• Version:
  1.0.0

Overview

This is a documentation-only CFO advisory skill with financial decision-support risk, but it does not run code, request credentials, persist data, or take privileged actions.

Install from the reviewed ClawHub package when possible. Use this skill as decision support for CFO, IPO, fundraising, M&A, and finance-strategy questions, but verify claims and consult qualified legal, accounting, tax, or investment professionals before acting on high-stakes recommendations.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The README describes activation in very broad terms: '只要在 WorkBuddy 对话中触发相关场景' and then lists many common finance-related scenarios without clear boundaries, constraints, or explicit trigger logic. This can cause the skill to activate in unintended contexts and provide authoritative CFO-style guidance when the user did not explicitly request this specific skill, increasing the risk of prompt hijacking of unrelated conversations or overreach into sensitive financial decisions.

VirusTotal

64/64 vendors flagged this skill as clean.