ROIC 核心穿透分析工具

• Outcome: Review
• Latest audit: May 28, 2026 · 11:48 AM UTC
• Version: 1.0.0

Overview

The skill appears to mix a ROIC financial-analysis assistant with unrelated QQ bot documentation and broad execution/network permissions, so users should review it carefully before installing.

Install only if you are comfortable with a finance skill that can run scripts, fetch external data, and write local reports. Verify whether the package is actually a ROIC tool or a QQ bot, use explicit prompts before allowing tool execution, and do not rely on its ROIC output for investment decisions without independent validation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 82% confidence
• Finding: The skill is presented as a precise ROIC calculator, but its behavior includes downloading external SEC/filing content, caching data locally, parsing filings with regex/iXBRL extraction, and producing intermediate JSON artifacts. That hidden expansion in behavior matters because users may not expect network access, local persistence, or lossy parsing paths that can introduce silent errors or leak data into local storage.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The README content is for a QQ bot built on NapCat/NoneBot2, while the skill metadata claims a ROIC financial analysis assistant. This kind of purpose mismatch is a strong supply-chain red flag because it can mislead reviewers and users about what the artifact actually does, increasing the chance that unrelated bot automation, account-linked functionality, or hidden capabilities are installed under a benign financial-analysis label.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill markets itself as providing precise ROIC calculations, but this file only fetches data and relies on incomplete fields, guessed fiscal-year mapping, hardcoded defaults, and fragile regex extraction from SEC HTML. In a financial-analysis skill, overstating precision can directly mislead downstream investment analysis and cause materially incorrect ROIC outputs to be trusted as authoritative.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The comment states A-share values are converted from ten-thousands of yuan to yuan, but the code merely copies floats without scaling. This creates systematic unit errors that can distort all downstream ROIC and balance-sheet calculations by orders of magnitude while appearing internally consistent.

Intent-Code Divergence

Low

• Confidence: 90% confidence
• Finding: The code claims to use iXBRL data attributes for precise extraction, but it actually strips HTML and runs broad regexes over free text. This is fragile and can silently extract the wrong period, wrong table, or unrelated values, especially in long annual reports with repeated labels.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README tells users to log in with a personal QQ account and enable local WebSocket/HTTP services, but provides no warning about account trust, bot-control exposure, privacy implications, or local service security. Even if bound to localhost, these instructions can lead users to expose messaging automation interfaces or operate a personally authenticated bot without understanding the risks, which is especially concerning in a package already exhibiting a purpose mismatch.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The auto-trigger conditions are broad and loosely bounded, covering common finance terms such as ROIC, capital efficiency, and related concepts. This can cause the skill to activate unexpectedly during ordinary financial discussion, leading to unsolicited tool use, network fetches, or file operations without clear user intent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The workflow says the script will automatically pull data from an API and generate a report, but it does not tell the user that network access and local processing/storage may occur. This is dangerous because users may unknowingly authorize outbound requests and artifact generation, which can affect privacy, compliance, reproducibility, and trust in the analysis pipeline.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill is configured to auto-activate on a very broad set of finance-related phrases, which can cause it to run in contexts where the user did not explicitly request this workflow. Because the workflow enables WebFetch and Bash and directs the agent to perform external lookups and local script execution, overbroad triggering increases the chance of unintended external access or local actions during ordinary financial discussion.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly permits Read, Write, Edit, WebFetch, and Bash, and later instructs the agent to run Python scripts, install packages, download PDFs, and parse external content without any requirement for user consent or warning. This creates a real risk of unreviewed local system modification, dependency installation, and outbound network activity, all of which expand the attack surface and can be abused through prompt-triggered execution paths.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger description is broad enough to match many ordinary finance conversations, which can cause the skill to auto-activate when the user did not explicitly request ROIC analysis. Because the skill has access to Read/Write/Edit/WebFetch/Bash, accidental invocation increases the chance of unnecessary tool use, unintended network access, and off-target responses.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill states that it will run a script that pulls data from an external finance-data API and generates a report, but it does not clearly disclose this behavior to the user at execution time. In a skill with WebFetch and Bash permissions, hidden or implicit network activity can expose user queries or trigger external actions without informed consent, which is a meaningful transparency and privacy risk.

Static analysis

No suspicious patterns detected.