Security audit

Daily Market Insight

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for an automated market-report workflow, but it asks agents to run undeclared local CLI commands and automatically publish reports to Feishu with limited user-control details.

Review this skill before installing. It will run daily, collect market news, generate financial analysis, create a Feishu document, and post a Feishu group message. Only use it where automatic Feishu publication is acceptable, and verify that opencode CLI execution and local git initialization are allowed in your environment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill is designed to automatically publish generated reports to Feishu and store artifacts locally, but it does not prominently warn users that collected content and generated analysis will be transmitted to an external service and persisted on disk. This can cause unintentional data disclosure, especially if search/fetch results, internal prompts, or derived content include sensitive information.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill instructs use of an external CLI (`opencode run`) and local repository initialization (`git init`) even though these capabilities are not declared in the manifest's required tools. This creates a capability mismatch that can lead an agent or operator to execute undeclared local commands, expanding trust boundaries and enabling unintended code execution or filesystem modification outside the expected tool sandbox.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The skill description is entirely in Chinese and specifies Chinese-language report generation behavior such as '每日市场洞察报告生成系统' without indicating that users can choose another language. Under the locale policy, forcing a specific language without opt-in is a natural-language policy concern.

Static analysis

No suspicious patterns detected.