Security audit

20位投资大师帮你分析股票

Security checks across malware telemetry and agentic risk

Overview

This stock-analysis skill is not malicious, but it needs Review because it ships an embedded market-data API token, can auto-trigger broadly, and gives direct buy/sell guidance without adequate user safeguards.

Install only after reviewing the finance and privacy risks. The publisher should remove and rotate the hardcoded Tushare token, require user-supplied credentials if Tushare is needed, fix setup.py, narrow or confirm auto-triggers, disclose all market-data providers, and clearly label outputs as informational analysis rather than personalized investment advice.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The script embeds a live API token directly in source code, which exposes credentials to anyone who can read the file, commit history, logs, or packaged artifact. Hardcoded secrets are easily reused or abused for unauthorized API access, quota exhaustion, billing impact, or account compromise, and the skill's simple data-fetching purpose does not justify shipping the credential in code.

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger conditions are extremely broad: common words like 'buy', 'sell', 'analysis', 'trend', or any stock-like term can activate the skill during ordinary conversation. In an agent environment, this can cause unintended invocation, unnecessary external data fetching, and context hijacking where the investment skill responds when the user did not explicitly request it, increasing privacy, cost, and reliability risks.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The skill sends user-derived stock queries to an external Tencent market-data API without any visible user notice, consent, or privacy control in this file. In agent environments, undisclosed outbound requests can leak user interests, prompts, or usage patterns to third parties and may violate privacy expectations or deployment policy.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The yfinance fallback performs another external network lookup with no clear disclosure or permission flow. This broadens data exfiltration surface and makes outbound behavior less predictable, especially when primary data retrieval fails and the code silently switches providers.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code returns concrete sector-based stock suggestions and guru-style buy/sell style advice without any visible disclaimer, suitability check, or risk warning. In a financial-decision context, presenting named securities and directional recommendations as plain output can mislead users into treating the tool as regulated investment advice, increasing the chance of harmful financial decisions.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The code sends user-supplied stock identifiers to external services via yfinance without any user-facing notice or consent mechanism. In an agent setting, this can leak user interests, trading intent, or proprietary watchlists to third parties, which is a meaningful privacy and data-governance risk even if the requests themselves are expected.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: A Tushare API token is hardcoded directly in source code, which exposes a credential to anyone with repository or artifact access. Even if the token only grants data-service access, it can be abused for unauthorized API consumption, quota exhaustion, billing impact, or account misuse, and hardcoded secrets are often propagated into logs, backups, and version history.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The hardcoded token is actively used to authenticate an external network call, meaning execution of this skill silently transmits and depends on embedded credentials without any disclosure or user control. In an agent-skill context, this is more dangerous because the skill can cause unauthorized third-party API usage under the developer's account and conceal credential misuse behind a routine data retrieval function.

Vague Triggers

High

Confidence: 96% confidence
Finding: The auto-trigger keywords are broad, common Chinese words such as '买', '卖', '分析', '怎么样', and '能买吗', which are likely to appear in ordinary conversation unrelated to intentional invocation of this finance skill. In an agent-integrated skill that can fetch realtime market data and provide investment analysis, this increases the chance of unintended activation, context hijacking, and unsolicited financial guidance being injected into user interactions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.