Etf Holdings Predictor

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed ETF market-analysis workflow, with the main caution that it may frame short-term predictions as trading guidance.

Install only if you want an ETF prediction assistant. Treat its output as market analysis, not personalized investment advice, verify the underlying data, and be cautious when prompts about ETF direction could trigger predictive trading guidance.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger list includes broad phrases such as ETF预测、ETF涨跌、ETF方向、成分股分析 that can overlap with ordinary market discussion, causing the skill to activate when the user did not intend to request this workflow. In an agent setting, overbroad activation can lead to unnecessary tool use, unexpected financial analysis, and responses framed as predictive advice in contexts where the user only wanted general information.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The activation condition says to use the skill whenever the user inputs an ETF code and asks about direction, options exercise direction, or directly says ‘预测XXX ETF’, but it does not define clear boundaries or exclusions. This ambiguity increases the chance of accidental invocation on routine finance conversations, which is more sensitive here because the skill performs market prediction and could steer users toward trading decisions they did not explicitly request.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal