Security audit

Unified Asset Advisor

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with generating Chinese-market asset allocation reports, but it needs review because it installs unpinned packages persistently and generates Excel files from unsanitized data.

Install only if you are comfortable with a China-market financial research skill that can install Python packages, fetch live market data, and write report files. Use an isolated workspace or virtual environment, review generated Excel files before sharing, and treat all investment, futures, and options recommendations as research output rather than personalized financial advice.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:61
Finding: Unpinned Runtime Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_xlsx.py:96
Finding: Spreadsheet Formula Injection Through Untrusted Report Values
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个完整的资产配置分析与报告生成技能，核心价值应是‘分析+建议+多格式输出’。但给定代码片段的实际功能是底层数据采集：抓取 PPI、CPI、PMI、GDP、M2、社融、LPR、全球指数、港股指数、中美国债利率、A股指数、期货主力列表及 ETF 数量，并最终输出 JSON。代码没有体现任何分析模型、行业研究逻辑、资产配置规则、报告模板渲染、Excel 多 Sheet 导出或策略生成能力。虽然数据抓取可被视为该技能的支撑步骤，但就该代码片段本身而言，与声明的主要用途存在明显且实质性的能力落差，因此应判定为不匹配。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill instructs reading local templates, references, and scripts, but it declares no explicit tool scope or allowed-tools boundary. In a skill that also writes reports and may invoke helper scripts, missing scope increases the chance of unintended file access or capability expansion beyond what the user expects.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are very broad and overlap with ordinary financial discussion, which can cause the skill to activate unexpectedly. Because this skill can gather market data, create files, and produce investment-style outputs, accidental activation may lead to unrequested actions or disclosure of overly specific financial guidance.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description is written as a Chinese-only skill specification and frames the output/report behavior entirely in Chinese without indicating that users may choose another language. Under the language policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill directs the agent to save HTML, Markdown, and Excel files to the working directory and deliver them, but it does not require explicit notice or consent before writing files. Silent file creation can surprise users, overwrite existing artifacts, or leak generated financial content into shared or persistent workspaces.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTML root sets lang="zh-CN", and the visible report content is entirely in Chinese, which indicates the skill output is fixed to a specific language/locale. The file does not provide any opt-in, alternative locale handling, or documented reason that the report must be China-specific from a policy perspective.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The entire template is written in Chinese and provides no indication that language selection is optional or configurable by the user. Under the policy for natural-language violations, forcing a specific language without opt-in can be a locale-policy issue unless the regional constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file contains user-facing natural-language instructions exclusively in Chinese, and nowhere indicates that the skill is limited to Chinese-speaking users or provides an opt-in for language selection. Under the policy rule for language or locale constraints, forcing a specific language without user choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document gives concrete futures and options trading recommendations, including directional trades, option structures, position sizing fields, and risk framing, but it lacks an explicit financial-risk disclaimer and does not clearly state that losses can exceed expectations, especially for leveraged derivatives and short-option strategies. In the context of an investment-advice skill, this omission increases the chance that users treat the content as actionable advice without adequate warning about suitability, leverage, margin calls, or substantial loss risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module docstring presents the script description and usage only in Chinese, which imposes a specific language on users without offering an alternative or opt-in. The same file continues this locale-specific behavior in sheet names and user-facing strings, indicating a natural-language policy issue rather than a code defect.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Worksheet titles, headers, and disclaimer text are all hard-coded in Chinese, so the skill enforces one language for generated outputs. The file does not offer any language selection mechanism or clearly justify a China-only scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The top-level docstring presents the skill name and usage entirely in Chinese, which imposes a specific language on users without any opt-in or alternative. Under the policy for natural-language violations, locale or language constraints should either offer choice or be clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.