六维共振量化助手

• Outcome: Review
• Latest audit: May 28, 2026, 11:29 AM
• Version:
  1.0.0

Overview

This is not malware, but it should be reviewed because it gives actionable stock-trading guidance while framing itself as only an analysis tool.

Install only if you deliberately want Chinese-language A-share stock analysis and understand it may produce trading-style recommendations. Treat any buy, sell, position-size, or stop-loss output as unverified decision support, not professional financial advice, and avoid automatic use on casual or ambiguous finance conversations.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill claims it is not a stock recommendation tool, but later explicitly instructs the assistant to provide buy/hold/sell advice, position sizing, and stop-loss guidance. This contradiction can mislead users and downstream systems about the skill's risk profile, causing the agent to deliver regulated or high-risk financial advice under a misleading disclaimer.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger description is broad enough to activate on many generic investing or learning queries, increasing the chance the skill is invoked outside its intended boundaries. In a financial context, over-triggering is risky because it can cause unsolicited or overly confident stock analysis to appear in situations where users did not explicitly request this specialized behavior.

VirusTotal

64/64 vendors flagged this skill as clean.