Security audit

Quant-X v13

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent A-share market analysis skill, with clear caveats that it contacts external market-data services and saves one local results file.

Before installing, be aware that running the script will contact Tencent and Eastmoney market-data endpoints and will attempt to save results to /workspace/v13/analysis_result.json. Treat its stock output as research only, especially because the model labeling is somewhat inconsistent and the artifact itself says it is not investment advice.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill advertises execution of a Python tool and references multiple external data sources, while the manifest does not declare any tool scope or permissions boundary for network or file-writing behavior. This creates an implicit-capability risk: users and host systems cannot clearly understand or constrain what the skill may access, increasing the chance of unexpected outbound requests or local file modification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script writes analysis output to a hard-coded path under /workspace/v13 without checking user intent, path safety, or whether disk persistence is appropriate. This creates an unintended data persistence side effect and can overwrite existing files or leak potentially sensitive analysis results in shared or multi-tenant environments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The policy check applies to all file types and includes language or locale restrictions imposed without user opt-in. The skill’s title, feature descriptions, usage context, and warnings are all presented only in Chinese, with no indication that users may choose another language or that the Chinese-only scope is a documented regional requirement.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill lists third-party market data providers but does not clearly warn that using the tool will initiate live network requests to external services. This weakens informed consent and can expose user IPs, timing patterns, or environment metadata to third parties, especially in restricted or privacy-sensitive deployments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The script makes outbound HTTP requests to Tencent and Eastmoney endpoints to retrieve quote, minute, and sector data. While network access is central to the script's function, the code does not provide an explicit user-facing warning before transmitting request metadata to external services.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Section headers, class docstring, and runtime output all state '6 因子综合评分', which tells users to expect a six-factor model. However, FACTORS contains eight entries: 趋势、动量、量价、波动、资金流向、DDX/DDY、板块、涨停, so the documentation actively misdescribes what the code is scoring.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The tool silently writes output to a fixed workspace file without warning or confirmation. In agent or hosted environments, unexpected file creation can expose data to other processes, overwrite prior results, or violate least-surprise expectations for a read-mostly analysis skill.
Content: No source excerpt is available for this finding.