Security audit

stock-portfolio-zh-aisa

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a local portfolio-management skill, but it can change or delete stored financial portfolio data and send portfolio tickers to a third-party pricing API without enough disclosed control.

Review carefully before installing. Only use this skill if you are comfortable storing portfolio records locally and sharing ticker symbols with the pricing provider. Back up the portfolio file first, and avoid letting an agent run delete or remove commands unless you explicitly asked for that exact change.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill declares environment requirements and clearly describes reading and writing portfolio state to a local file, but it does not declare corresponding permissions. This weakens user and platform transparency because the skill can access secrets via environment variables and persist data locally without an explicit permission contract.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The description presents a narrower capability set than the documented behavior, omitting destructive and state-changing actions such as deleting portfolios, removing holdings, updating positions, listing all portfolios, and persisting data locally. This mismatch can cause users or orchestrators to invoke the skill without understanding that it can alter or delete stored financial data on disk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill sends the user's portfolio tickers to a third-party API to obtain prices, but the CLI help text and module description do not clearly disclose that holdings data will leave the local environment. Even though only tickers are transmitted, portfolio composition can still reveal sensitive investment interests or strategies, and the skill context makes this more significant because users may expect a local portfolio manager to keep holdings private.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Asset removal executes immediately with no confirmation prompt, dry-run option, or undo, making accidental loss of locally stored portfolio data easy. This is primarily an integrity/usability risk rather than a direct security compromise, but in an agent-driven context unintended destructive actions are more likely and therefore more dangerous.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Whole-portfolio deletion is irreversible and occurs without any confirmation, increasing the chance of accidental or agent-induced destructive data loss. Because this operation deletes all holdings in a portfolio, the impact is higher than single-asset removal even though the data is local.

Static analysis

No suspicious patterns detected.