fin-ai-classifier

• Outcome: Pass
• Latest audit: Sep 18, 2026 · 10:37 AM UTC
• Version: 1.0.0

Overview

This is a small local decision-support CLI that classifies financial AI application risk levels and does not show hidden access, persistence, network use, or destructive behavior.

Before installing, treat the output as a rough compliance aid only and verify against current official regulatory text or qualified counsel. Non-Chinese users should expect limited localization, and the README examples include an apparent stale option name, but the security footprint is narrow.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The natural-language content of the skill, including its title, description, warnings, usage notes, and FAQ, is presented only in Chinese. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation unless the restriction is explicitly justified as region-specific, which is not stated here.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The module docstring presents the tool’s purpose, limitations, and regulatory framing only in Chinese. Because this is a natural-language constraint that effectively forces a specific language without user opt-in or a documented region-specific justification in the file, it matches the language/locale policy violation criterion.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Argument help text, parser description, and disclaimer fields are user-facing strings written only in Chinese. The file does not offer an alternative language, locale selection, or clearly justified region-only scope, so this is a language policy issue under the natural-language policy rule.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The text states that the documentation is available in Chinese (`中文文档见 SKILL.md`) and does not indicate any alternative language option or user choice. This can be a language/locale policy issue because the skill appears to require or prioritize a specific language without opt-in.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

out_list.append({"tool": META["slug"], "input": d, "errors": [str(e)], "rc": 2, "aigc_mark": AIGC})
        print(json.dumps(out_list, ensure_ascii=False, indent=2))
        sys.exit(0 if allok else 2)
    args = {k: getattr(ns, k) for k in argnames}
    try:
        res, rc = _run(args)
    except GateError as e:

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Static analysis

No suspicious patterns detected.