marcus-investment-analyst

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 9:40 PM UTC
• Version: 1.0.0

Overview

This is a disclosed Chinese-language A-share analysis and backtesting skill that saves local market-analysis data but does not show deception, credential use, exfiltration, or trading-account control.

Install this only if you want a Chinese-language A-share technical-analysis tool. Before running scripts, expect external market-data calls, local SQLite updates under /root/data, and saved backtest JSON files; do not treat its stock recommendations as licensed or personalized financial advice.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The description suggests a complete RSI-enabled analysis and backtesting skill, but the detected implementation appears limited to a narrower 缠论 analysis module without full RSI or backtest functionality. In security terms, capability mismatch undermines informed consent and safe routing decisions, because the skill may be invoked under false assumptions about both what it does and what it does not do.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The description suggests a complete RSI-enabled analysis and backtesting skill, but the detected implementation appears limited to a narrower 缠论 analysis module without full RSI or backtest functionality. In security terms, capability mismatch undermines informed consent and safe routing decisions, because the skill may be invoked under false assumptions about both what it does and what it does not do.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The description suggests a complete RSI-enabled analysis and backtesting skill, but the detected implementation appears limited to a narrower 缠论 analysis module without full RSI or backtest functionality. In security terms, capability mismatch undermines informed consent and safe routing decisions, because the skill may be invoked under false assumptions about both what it does and what it does not do.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The invocation examples use very broad natural-language phrases such as '分析一下江波龙' and '有什么投资建议？', which can easily overlap with ordinary user conversation. In an agent environment, this can cause accidental skill activation in contexts where the user did not explicitly intend to invoke an investment-analysis capability, potentially leading to unintended financial guidance or execution of related workflows.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 73% confidence
• Finding: The skill advertises execution of local Python scripts and references writing updated indicator data to databases and JSON outputs, but it does not declare any explicit tool scope or allowed-tools boundaries. This creates a governance gap where an agent may invoke file-writing or code-execution behavior without clear least-privilege constraints, increasing the chance of unintended filesystem modification.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases are very broad generic investment requests such as stock analysis, backtesting, and investment advice, which can cause the skill to activate in many ordinary conversations. Overbroad activation increases the risk of inappropriate tool use, accidental script execution, or unsolicited financial-advice behavior in contexts where the user did not clearly request this specific skill.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The usage conditions define broad activation criteria without strong boundaries, covering analysis, backtesting, advice, and data download/update. This makes the skill more dangerous because it bundles higher-risk actions, including data modification, under vague conditions that may be interpreted too permissively by an agent.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This JSON file stores all stock names, sectors, and strategy names exclusively in Chinese, indicating a hard-coded locale assumption across the skill data. For a general-purpose skill, forcing a single language without offering a choice or documenting a region-specific constraint is a natural-language policy issue.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown file presents all user-facing content in Chinese, including headings, instructions, and recommendations, with no indication that the user opted into that language or that the skill is region-specific. The policy requires flagging language or locale constraints when a specific language is forced without user choice or clear justification.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The document provides concrete buy/sell triggers, stop-loss and take-profit rules, position sizing, named stocks, and even labels the strategy as '实盘就绪' (live-ready) without any risk disclosure, suitability warning, or limitation statement. In an investment-analysis skill, this materially increases the chance that users treat the content as actionable financial advice and incur financial loss by following it without understanding market, liquidity, or suitability risks.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The module docstring states the skill is for 'MACD 和 RSI' and says it computes and stores those indicators, but the implementation creates a stock_kdj table, calculates KDJ values, and saves them to the database. This is a clear manifest/documentation-to-behavior mismatch because KDJ is an additional analysis capability not disclosed in the file description.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The docstring says '/root/data/astock_indicators.db (新文件，不覆盖已有)', implying existing data will not be overwritten. However, save_indicators_to_db uses 'INSERT OR REPLACE' for MACD, RSI, and KDJ rows, which will overwrite existing records with the same unique key. That is an active contradiction between stated intent and actual write behavior.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code file contains natural-language strings and docstrings that force a specific language/locale for users, including the module description and later console output. The policy allows locale constraints only when user choice is offered or the restriction is clearly documented and justified, which is not present here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module description, docstrings, and printed user-facing messages are consistently fixed in Chinese, with no indication that the user can choose another language. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The inline comment for the bullish case states '价格新低，MACD 面积/峰值上升', which implies the second negative-area magnitude should improve relative to the first. However, the implemented condition is `area2 < area1 * 0.8`, meaning the second area is smaller than the first; this contradicts the stated intent of the comment and can mislead maintainers about the actual signal logic.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: Natural-language policy issues include forcing a specific language without user opt-in. This README uses only Chinese for the skill name, description, usage, and support text, with no indication that users may choose another language or that the locale restriction is intentional and justified.

Natural-Language Policy Violations

Low

• Confidence: 75% confidence
• Finding: The manifest description and the entire skill guidance are presented only in Chinese, and the file does not indicate that the user can choose another language. Under the stated policy, a skill should not force a specific language or locale without opt-in or clear justification.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This file contains all user-facing instructions in Chinese only, with no indication that users may choose another language or that the Chinese-only presentation is a justified regional constraint.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The module docstring and later console messages are written exclusively in Chinese, which imposes a specific language on users. The file does not indicate that the skill is intended only for a Chinese-speaking or China-specific deployment context, nor does it provide any opt-in or alternative locale handling.

Description-Behavior Mismatch

Low

• Confidence: 87% confidence
• Finding: The manifest describes the skill as providing stock analysis, backtesting, and investment advice based on Chan theory, MACD, and RSI. This file not only performs backtesting but also persists detailed results to disk as a JSON export, which is an additional behavior not mentioned in the skill description.

Description-Behavior Mismatch

Low

• Confidence: 83% confidence
• Finding: The file-level docstring presents the module as a technical-pattern analysis component for 缠论 recognition, but the executable entrypoint also fetches stock history from AkShare over the network. While data retrieval may support stock analysis overall, it is broader than this module's stated role as an analysis module and is not described in the module documentation.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This Python file performs an outbound network call via akshare to retrieve stock history data, which is a safety-relevant operation under the audit rules for code files. Although the script prints that it is fetching data, it does not disclose that this involves contacting an external service or any related privacy/network implications.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The natural-language description and user-facing labeling in this file are exclusively Chinese, with no indication that the skill is intentionally limited to Chinese-speaking users or that language selection is configurable. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy issue.

Description-Behavior Mismatch

Low

• Confidence: 91% confidence
• Finding: The script persists backtest results into workspace storage under /root/.openclaw/workspace/memory/stock-analysis/ without any indication that the user explicitly requested long-term retention. In an agent-skill context, silent persistence can create privacy, data-retention, and operational risk because analysis inputs and derived recommendations may accumulate and later be exposed to other components or users.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: The code writes a JSON output file to disk automatically and does not warn the user or request confirmation about the output location. In a skill that appears to provide analysis/advice, this hidden side effect violates least surprise and can leak portfolio interests, strategy outputs, or internal analysis artifacts into persistent storage.

Static analysis

No suspicious patterns detected.