stock-manage-skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:12 AM UTC
• Version: 1.0.2

Overview

This stock-management skill is mostly coherent, but it needs Review because its log-deletion command can delete files outside the log folder and one market-data fallback uses unencrypted HTTP.

Install only if you are comfortable with a local stock tool that writes JSON files, keeps logs/backups, contacts public market-data providers, and can delete local records. Before trusting it in a broad filesystem environment, the publisher should constrain log deletion to approved log filenames, remove plaintext HTTP fallback, add confirmations or dry runs for destructive cleanup, and clarify third-party API data sharing.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: log_manager.py:69

Finding

Arbitrary File Deletion Through Path Traversal in Log Deletion

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: stock_info.py:180

Finding

Unauthenticated Plaintext HTTP Used for Financial Market Data

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (45)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill performs external API access that is not clearly declared in its primary purpose and permission model, users may unknowingly send stock symbols, usage patterns, or related metadata to third parties. Undeclared network egress is a security and privacy issue because it bypasses informed consent and weakens review of data flows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill performs external API access that is not clearly declared in its primary purpose and permission model, users may unknowingly send stock symbols, usage patterns, or related metadata to third parties. Undeclared network egress is a security and privacy issue because it bypasses informed consent and weakens review of data flows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

If the skill performs external API access that is not clearly declared in its primary purpose and permission model, users may unknowingly send stock symbols, usage patterns, or related metadata to third parties. Undeclared network egress is a security and privacy issue because it bypasses informed consent and weakens review of data flows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If the skill performs external API access that is not clearly declared in its primary purpose and permission model, users may unknowingly send stock symbols, usage patterns, or related metadata to third parties. Undeclared network egress is a security and privacy issue because it bypasses informed consent and weakens review of data flows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the skill performs external API access that is not clearly declared in its primary purpose and permission model, users may unknowingly send stock symbols, usage patterns, or related metadata to third parties. Undeclared network egress is a security and privacy issue because it bypasses informed consent and weakens review of data flows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the skill performs external API access that is not clearly declared in its primary purpose and permission model, users may unknowingly send stock symbols, usage patterns, or related metadata to third parties. Undeclared network egress is a security and privacy issue because it bypasses informed consent and weakens review of data flows.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 407)May include surrounding context.

md

1. **技能定义**：`SKILL.md` - 定义了股票管理技能的配置和功能

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements generic log management, including listing, sizing, and deletion of filesystem files, which is outside the stated stock-order and stock-information purpose of the skill. Capability drift is dangerous in agent skills because unrelated file-management features expand the attack surface and can be invoked in ways users would not reasonably expect from a stock-management tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code exposes destructive filesystem operations through delete_log_file, delete_old_logs, and clear_all_logs, allowing removal of files under a configured directory. In the context of a stock-management skill, these deletion capabilities are unjustified and materially increase the risk of data loss, anti-forensics behavior, or abuse if filename or directory configuration is influenced by an attacker or unsafe caller.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

clear_all_logs irreversibly deletes every file in the configured log directory with no prior disclosure, confirmation, or rollback path. In this skill context, that is especially dangerous because wholesale log wiping is unrelated to expected stock-management behavior and could destroy evidence of misuse or operational failures.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · stock_rule.py (reported line 185)May include surrounding context.

python

json.dump(rules, f, ensure_ascii=False, indent=2)

            logger.info(f"成功添加规则: {rule_id} - {rule_name}({rule_type})")
            return rule_id

        except Exception as e:
            logger.error(f"添加规则失败: {e}")

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · stock_rule.py (reported line 218)May include surrounding context.

python

json.dump(rules, f, ensure_ascii=False, indent=2)

            logger.info(f"成功添加规则: {rule_id} - {rule_name}({rule_type})")
            return rule_id

        except Exception as e:
            logger.error(f"添加规则失败: {e}")

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · stock_rule.py (reported line 200)May include surrounding context.

python

try:
            with open(self.rule_file, 'r', encoding='utf-8') as f:
                rules = json.load(f)
            return rules
        except Exception as e:
            logger.error(f"获取规则失败: {e}")
            return []

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents capabilities that imply filesystem read/write and external network access, but it does not declare any explicit tool scope or permissions. In an agent environment, missing scope boundaries can let the runtime grant broader capabilities than users expect, increasing the blast radius of prompt injection or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Documented delete operations remove persisted order data, but there is no warning, confirmation flow, or mention of recovery expectations. In an agent setting, destructive commands can be triggered accidentally or via prompt manipulation, causing irreversible local data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill describes sending stock queries to external public APIs without warning users that their requests and metadata may be disclosed to third parties. Even if the payload seems low sensitivity, hidden outbound requests undermine informed consent and can expose usage patterns or proprietary watchlists.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Automatic cleanup of old stock data and logs can silently delete information that may be needed for audit, troubleshooting, or compliance, yet the documentation does not warn users clearly. When paired with agent automation, unattended cleanup raises the risk of unexpected data loss.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation simultaneously claims no network dependency and also describes live stock retrieval through public APIs. Contradictory security-relevant documentation can mislead users and reviewers about whether data leaves the local environment, creating privacy and trust risks.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring says the skill is for stock prediction, including optimal stock selection and rise-probability prediction, while the manifest describes a stock management skill focused on order management, trading rule management, and stock information retrieval. This is an active documentation-level contradiction about the skill's intended function, not just an omitted detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

All recognized command triggers are hard-coded Chinese phrases such as 保存股票订单, 查看股票订单, and 删除订单, with no indication that other languages are supported or that the user can choose the locale. This creates a natural-language policy concern because the skill effectively forces a specific language without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The delete operation is executed immediately based on parsed input, with no confirmation, undo, or secondary validation. In an agent setting handling natural-language commands, this increases the chance of accidental or mis-triggered destructive actions leading to loss of locally stored order records.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

delete_log_file removes a specified file immediately with no confirmation, safety prompt, soft-delete, or recovery mechanism. In an agent setting, a mistaken invocation or adversarial prompt chain could cause irreversible deletion of operational logs, hindering troubleshooting and accountability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

delete_old_logs performs bulk deletion based solely on file modification time and a caller-provided days value, without warning, confirmation, or safeguards against overly broad deletion. This can erase historical logs needed for investigations or compliance, especially if the threshold is misconfigured or manipulated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill's user-facing descriptions, help text, prompts, and outputs are entirely in Chinese, which imposes a fixed language on all users. There is no visible opt-in, locale selection, or documentation that the tool is intentionally restricted to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes managing stock orders, trading rules, and retrieving stock information using a local text directory. This file additionally exposes a top-level log command with listing, sizing, and deletion operations, which is a distinct log-administration capability not described as part of the skill’s purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.