VC 尽职调查与投资决策

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:35 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches VC diligence work, but it also tells the agent to publish potentially sensitive deal analysis to an external ima knowledge channel without a clear final approval step.

Review this skill carefully before installing. It is reasonable for drafting VC diligence materials, but only use the ima publishing step when you intentionally want the exact final report sent to that knowledge channel; verify destination, permissions, redactions, and approval before any publication.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:65

Finding

External Publication of Sensitive Due-Diligence Data Without Explicit Final Approval

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 65–68
Vulnerability Type: Unapproved external data publication
Risk Level: Medium

Vulnerable instruction, translated into English:

markdown

## Publish to the ima Knowledge Channel
1. Confirm that `ima-mcp` is connected; if it is not connected, authorize it on the connector management page.
2. Publish the Markdown output as an entry in the target knowledge channel through the ima MCP tool. Splitting it into a diligence checklist, valuation, and IC memo is recommended, although it may also be published as one long article.
3. Return the entry link or ID and a summary.

Technical Analysis

The Skill directs the Agent to transmit generated content to an external knowledge service through an MCP connector. Although it requires the connector to be authorized, it does not require explicit user confirmation immediately before publication. It also lacks controls for reviewing the destination, access permissions, visibility, and final content.

This is particularly sensitive because the Skill processes venture-capital due-diligence information. Generated reports may contain financial statements, valuation assumptions, capitalization details, contractual risks, founder information, legal findings, intellectual-property information, and confidential investment recommendations.

Connector authorization alone does not establish that the user intends to publish every generated report. The missing approval and redaction controls create an unsafe external side effect. This is classified as T09: Insecure Skill Coding Practices because the Skill configuration does not safely handle potentially sensitive information before an external write operation.

Attack Path

1. A user supplies confidential company, founder, legal, financial, or transaction information for diligence analysis.
2. The Skill incorporates that information into the diligence checklist, valu ...[truncated 1575 chars]

Remediation

View remediation

Remediation Suggestions

1. Make external publication explicitly opt-in rather than an automatic step.
2. Generate the report locally by default and ask whether the user wants it published.
3. Immediately before the MCP write operation, display:
   • The complete content or a reviewable preview.
   • The target workspace and knowledge channel.
   • The destination visibility and access permissions.
   • The fields that were redacted or retained.
4. Require explicit confirmation for that specific content and destination. Prior connector authorization must not count as publication approval.
5. Apply data-minimization and redaction controls by default, including removal of personal data, confidential financial details, contract terms, capitalization information, credentials, and source-document contents unless specifically approved.
6. Allow the user to cancel publication without losing the locally generated report.
7. Validate the destination identifier against an approved workspace or channel allowlist.
8. Return the publication ID and effective visibility after publishing so the user can verify or remove the entry.
9. Record an auditable publication event containing the approving user, destination, timestamp, and content classification, without duplicating sensitive report content in logs.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill's core purpose is to generate diligence checklists, valuation models, and IC memos, but it also instructs the agent to publish the generated content to an external ima knowledge account. This expands the skill from analysis into external side-effecting behavior, creating a risk of unintended disclosure of confidential deal information or unauthorized publication if invoked in the wrong context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Publishing to an external knowledge base is not necessary to fulfill the stated diligence and investment decision support function, so the capability is broader than the declared purpose. That mismatch increases the chance that sensitive investment analyses, startup data, or internal recommendations are exfiltrated or shared outside approved channels under the guise of a normal content-generation workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The file presents the skill as operating in Chinese and includes Chinese-first instructions, while also embedding an English sentence, but nowhere states that the user can choose output language. This can create an implicit locale expectation without explicit opt-in, which falls under the language/locale policy check.

Content

No source excerpt is available for this finding.