Security audit

Due Diligence Analyst

Security checks for vulnerabilities and agentic risk

Overview

The skill does not look malicious, but it overstates high-stakes due-diligence abilities and handles potentially sensitive business prompts with weak scoping.

Review this skill before installing for investment or compliance work. Treat outputs as draft guidance only, avoid entering confidential or personal background-check data unless your OpenClaw logging and LLM data handling are acceptable, and verify all facts through official or professional sources.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (47)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README advertises founder/executive background verification and credit record checks but does not present any privacy, consent, lawful-basis, or jurisdictional restrictions near those features. Because this skill is intended for automated due diligence across messaging channels, users may be encouraged to run highly sensitive investigations without proper notice, authorization, or compliance controls, creating privacy, regulatory, and misuse risk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The declared description promises automated comprehensive due diligence spanning financial, legal, business, and team dimensions for investment decisions. The supplied code only supports a limited subset: basic company information, equity/shareholder structure, related parties, historical changes, and preliminary risk prompts. There is no implementation for financial analysis, legal diligence, management/team evaluation, or broader investment-decision support workflows. The only data collection function is an unimplemented placeholder, so the behavior is mainly LLM-generated narrative analysis rather than comprehensive automated due diligence. Therefore, the description materially overstates the code’s actual scope and capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: There is a material description-to-behavior mismatch. The declared purpose promises automated comprehensive due diligence across multiple dimensions for investment decisions. In contrast, the code primarily prompts an LLM to draft a quick due diligence report based only on a company name, with a disclaimer that it is based on limited information and intended only for preliminary decision support. Full and specialized reports are not implemented, and there is no concrete evidence of data gathering, financial/legal/business/team analysis workflows, or verification mechanisms. This is more accurately a quick report drafting tool than a comprehensive due diligence analysis system.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description overstates the implemented functionality. While the code is aligned in general domain and intent with due diligence analysis, the primary promised capability—automated comprehensive due diligence across multiple dimensions—is not actually implemented. The handleFullDD path returns a 'development in progress' message listing future features, and handleReportGeneration also returns a placeholder. The implemented behavior mainly consists of keyword-based intent routing, company analysis via companyAgent, quick DD via company analysis plus a quick report, and generic LLM-based answers. There is no evidence in this chunk of actual financial, legal, business, or team diligence automation at the comprehensive level described.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises a substantive AI-powered due diligence analysis capability. However, the provided code chunk is effectively empty: it contains only a comment indicating company-related type definitions and an empty export. There is no implemented analysis, no data processing, no investment decision support logic, and no evidence of any functional behavior matching the declared purpose. This is therefore a material description-to-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This code chunk does not implement the declared due diligence functionality. It is merely an index file that re-exports definitions from other modules, which is a packaging/support detail rather than the described primary purpose. Because the observable behavior in this chunk is unrelated to comprehensive due diligence analysis and shows no substantive analysis capabilities, the description is not accurately represented by the supplied code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Yes, this is a mismatch. The declared description promises substantive AI-powered due diligence analysis, but the supplied code chunk is effectively empty runtime code with only a comment about report-related type definitions. There is no evidence of analytical functionality, data processing, investment decision support, triggers, or permission use. This is not merely an internal helper implementing the described behavior; it does not implement any meaningful part of the declared primary purpose in the provided chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises substantial due diligence analysis functionality, but the supplied code chunk does not implement any such behavior. It is effectively a no-op module with only a comment about risk assessment-related type definitions and an empty export. This is a material mismatch in primary purpose: the description describes a full analytical skill, while the code shown has no operational capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This code is purely a type definition file describing generic interfaces for LLM responses, chat messages, skill context, skill responses, and the Skill contract. It contains no executable logic specific to due diligence, investment analysis, or any of the declared domains. Therefore the declared description does not accurately represent what this code chunk actually does; the chunk serves as framework/type infrastructure rather than an AI-powered due diligence analysis capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Yes, this is a mismatch. The declared description promises a substantive due diligence analysis capability for investment decisions, but the provided code chunk is მხოლოდ a type/interface file placeholder with no executable logic implementing that behavior. There are no undeclared malicious capabilities visible, but the actual code does not support the declared primary purpose at all.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a comprehensive AI-powered due diligence capability for investment decisions. However, the provided code chunk is only a TypeScript declaration file for generic formatter helpers and ID generation. These are incidental utility functions and do not implement or expose substantive due diligence analysis behavior. This is a material mismatch in primary purpose and capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises comprehensive automated due diligence analysis for investment decisions, implying substantive analytical functionality across multiple domains. The actual code chunk is a utility formatter module with presentation helpers and simple ID generation. While some helpers like risk level or rating formatting could support a due diligence application, this chunk by itself does not perform analysis, data access, or domain-specific due diligence tasks. Therefore, the code's actual behavior does not accurately represent the declared primary purpose.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example invocation phrases are very broad and can cause the skill to activate on generic company-analysis requests without clearly scoped consent, tenant, or task boundaries. In a messaging-channel context, this increases the risk of unintended triggering, over-collection of sensitive data, or execution in contexts where the user did not explicitly request due diligence operations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The 'General Consultation' section presents activation examples like 'What is due diligence?' and 'How to assess a company's financial health?', which are common conversational questions rather than narrowly scoped skill triggers. The file does not provide exclusion conditions or clearer constraints for when these questions should invoke this skill versus a general assistant response.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The natural-language comments describe the agent exclusively in Chinese, while the file otherwise uses English identifiers and provides no indication that language selection is optional or region-specific. This can violate language/locale policy when a skill implicitly constrains communication to a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file's natural-language description states 负责公司基本信息分析, and all embedded system prompts and user messages are written only in Chinese, implying the skill operates in a fixed language. There is no indication that users can choose another language or that the Chinese-only constraint is documented as a justified locale-specific requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language description "负责尽调报告生成" is presented only in Chinese, and the method comments are also Chinese-only. This indicates a language constraint in the skill's user-facing documentation without offering a language choice or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill metadata promises comprehensive due diligence across financial, legal, business, and team dimensions, but the implemented agent only produces a quick LLM-generated report and explicitly leaves full and specialized reports unimplemented. In an investment due-diligence context, this can mislead users into relying on incomplete analysis for high-stakes decisions, creating a material integrity and trust risk even without direct code execution or data exfiltration.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The system prompt is written to require report generation in Chinese and does not provide any user opt-in or alternative language handling. This creates a language policy issue because the skill effectively enforces a specific language/locale by default.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill metadata and top-level behavior present this agent as performing comprehensive due diligence across financial, legal, business, and team dimensions, but the implementation only provides basic intent routing, a company analysis call, and placeholder responses for major features. In a due-diligence context, overstated capability can cause users to rely on incomplete analysis for investment or compliance decisions, creating a safety and integrity risk even without direct code execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The handler logs the full user message verbatim, which may contain sensitive corporate, legal, financial, or personal information typical of due-diligence requests. If logs are stored centrally, exposed to operators, or retained insecurely, this creates a straightforward confidentiality risk and broadens the blast radius of any downstream log compromise.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The system prompt instructs the LLM to behave as if it can assess financial health, identify legal/compliance risk, evaluate management, and provide investment advice, but this file does not implement verifiable retrieval, validation, or specialized workflows for those tasks. In a high-stakes due-diligence setting, this encourages authoritative hallucinations and can mislead users into treating unsupported model output as real analysis.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The system prompt is entirely written in Chinese and instructs the model in a way that implies Chinese-language operation by default, without asking the user for a preferred language. This can violate language/locale policy when no opt-in or documented regional constraint is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This formatter hard-codes a Chinese default currency (CNY) and Chinese large-number units (亿, 万), which imposes a specific locale in output. Under the policy, locale-specific behavior should be optional or clearly justified; this file provides no opt-in or documented regional constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The functions return Chinese labels like 低, 中, 高, 严重, and recommendation text such as 优秀 - 强烈推荐, with no mechanism for the user to select language. This is a natural-language policy issue because the file enforces a specific language rather than offering localization or documenting a justified language restriction.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.