Stock Analysis

• Outcome: Pass
• Latest audit: Jul 22, 2026 · 1:41 AM UTC
• Version: 0.1.0

Overview

This stock-analysis skill is a disclosed market-analysis orchestrator that fetches public stock data and stores local reports, with some documentation and install-supply-chain caveats users should review.

Install only if you are comfortable with the skill contacting public Chinese market/news data providers using stock codes or keywords you request, and with reports/context snapshots being saved locally. Review or pin the sibling a-stock-data download before installing, especially because the README uses a mutable GitHub raw URL and persistent agent skill paths.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documents capabilities to read environment variables, read/write local files, use sqlite, and make outbound network requests, but it does not declare permissions explicitly. That creates a transparency and policy-enforcement gap: an agent or reviewer may assume the skill is less privileged than it really is, while the skill can still persist data locally and contact external services. In a security-sensitive agent environment, undeclared capabilities increase the chance of unauthorized data access, persistence, or exfiltration through normal-looking analysis flows.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill claims to be a thin orchestrator that delegates data retrieval to a sibling skill, but the documented behavior shows it also performs direct K-line/quote/news retrieval, source probing, failover, and local persistence of source state. This mismatch is dangerous because trust decisions, sandboxing, review scope, and operator expectations will be based on the declared low-risk orchestration role, while the actual behavior has broader network and storage reach. Hidden or understated direct-fetch logic expands attack surface and can bypass controls intended for the delegated data skill.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The documentation contradicts itself on whether K-line/quote retrieval is delegated or performed locally. Contradictory security-relevant documentation can cause reviewers and orchestrators to apply the wrong trust model, such as allowing the skill where only non-network orchestration was expected. That confusion can lead to accidental exposure to external services or unreviewed local state persistence.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest description says all market and related data is delegated to a-stock-data, but the body states this skill performs its own K-line/quote retrieval. Security tooling and human reviewers often rely on top-level manifest descriptions for quick risk classification; if that summary understates direct network behavior, it can conceal meaningful capability from governance checks. In an agent ecosystem, misleading manifests increase the risk of over-permissive deployment and insufficient review.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The README instructs users to activate the skill with ordinary natural-language phrases such as asking to analyze a stock. Broad trigger phrases increase the chance of unintentional activation during unrelated conversation, which can cause the agent to load this skill and execute its orchestration unexpectedly. In this skill’s context, unexpected activation is meaningful because the skill can drive network fetches, sibling-skill loading, and report persistence.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The skill allows reports and analysis results to be written to files or sqlite without a prominent user-facing warning that analysis inputs and outputs may be persisted. Even if stock analysis is usually low sensitivity, prompts, notes, watchlists, strategy rationales, or user-supplied context may still be private, and silent persistence can create retention and disclosure risk on shared systems. The danger is increased by optional custom storage paths that may place data outside expected skill-local storage.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill stores analysis outputs, metadata, and context snapshots to local files or SQLite without any explicit user-facing notice or consent flow. Because context packs may contain user queries, stock interests, model outputs, and fetched external data, this can create unintended retention of potentially sensitive usage history on disk.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The orchestration explicitly describes fetching market and related data from multiple external network sources, but there is no corresponding warning that user requests or derived identifiers may trigger outbound access. In agent environments, undisclosed network access can violate user expectations, privacy requirements, or deployment policy, especially when source discovery and fallback behavior vary by machine/network.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

cp -r stock-analysis ~/.claude/skills/stock-analysis

# 2. 安装 sibling skill a-stock-data（数据层，必装）
mkdir -p ~/.claude/skills/a-stock-data
curl -o ~/.claude/skills/a-stock-data/SKILL.md \
  https://raw.githubusercontent.com/simonlin1212/a-stock-data/main/SKILL.md

• Confidence: 80% confidence
• Finding: dir -p ~/.claude/skills

Skill Enumeration

Medium

• Category: Agent Snooping

Content

# 2. 安装 sibling skill a-stock-data（数据层，必装）
mkdir -p ~/.claude/skills/a-stock-data
curl -o ~/.claude/skills/a-stock-data/SKILL.md \
  https://raw.githubusercontent.com/simonlin1212/a-stock-data/main/SKILL.md

# 3. 安装 a-stock-data 的依赖（本 skill 自身零 pip 依赖）

• Confidence: 77% confidence
• Finding: skills/a-stock-data/SKILL.md

Session Persistence

Medium

• Category: Rogue Agent

Content

cp -r stock-analysis ~/.claude/skills/stock-analysis

# 2. 安装 sibling skill a-stock-data（数据层，必装）
mkdir -p ~/.claude/skills/a-stock-data
curl -o ~/.claude/skills/a-stock-data/SKILL.md \
  https://raw.githubusercontent.com/simonlin1212/a-stock-data/main/SKILL.md

• Confidence: 82% confidence
• Finding: mkdir -p ~/.claude/skills/a-stock-data curl -o ~/.claude/skills/a-stock-data/SKILL.md \ https://raw.githubusercontent.com/simonlin1212/a-stock-data/main/SKILL.md # 3. 安装 a-stock-data 的依赖（本 skill 自身

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.