aggressive_growth_strategy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:54 AM UTC
• Version: 1.0.0

Overview

This stock-analysis skill is coherent in purpose, but it can produce actionable trading and position guidance from incomplete or unverified financial data.

Review carefully before installing. Use this only as a research aid, not as personalized financial advice, and verify all figures independently. Avoid following its position sizing, buy, or sell guidance when any data source fails or financial verification is incomplete. Install dependencies only in an isolated environment with pinned, reviewed package versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:301

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/screen_stocks.py:221

Finding

Stock Screening Fails Open When Mandatory Criteria Are Unavailable

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/analyze_stock.py:319

Finding

Unverified Financial Figures Remain in the Analysis Report

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/judge_market.py:345

Finding

Complete Market-Data Failure Produces Positive Allocation Guidance

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

描述涵盖多个高层能力：筛选、深度分析、市场阶段判断、仓位策略、建仓/卖出计划制定。当前代码块只对应其中一部分——“七标准筛选小盘成长股”的执行脚本，且是CLI筛选器，不包含八步分析流程、市场季节识别逻辑、仓位建议、建仓计划或卖出计划生成。因此，虽然数据源说明与选股部分基本一致，但整体声明明显宽于该代码的实际功能，构成描述与行为不一致。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill explicitly instructs the agent to run shell commands and install packages, but it does not declare any tool scope, permissions, or allowed-tools boundary. In an agent environment, this creates an authority gap where broad shell execution may be available without least-privilege constraints, increasing the chance of unintended command execution, package installation, or network access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is designed to influence stock selection, market timing, and position sizing, yet it lacks a prominent upfront warning about financial risk and decision impact. In this context, omission of such a warning is dangerous because users may treat the output as authoritative trading advice, especially when the skill presents structured scoring, buy plans, and sell ladders.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions are broad enough to match ordinary investing conversations, which can cause the skill to activate in contexts where the user did not intend portfolio-influencing analysis or tool-backed data collection. In agent systems, overly broad activation increases the risk of unnecessary tool use, inadvertent execution of shell-backed workflows, and unrequested financial guidance affecting user decisions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document defines criterion 7 earlier as a mandatory exclusion check that adds no points, but the summary table later relabels it as 'valuation' and assigns 10 points. In a trading-analysis skill, this inconsistency can cause the agent or user to score and rank stocks incorrectly, potentially admitting disallowed securities or overweighting a factor that was supposed to be a hard gate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring and usage/output description are written entirely in Chinese and state that the output is a Markdown analysis report, while the report body later also emits Chinese-only content. For a generally usable analysis script, this constitutes a language-policy issue because it hard-codes a specific locale without any opt-in or alternative language selection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The generated Markdown report, ratings, warnings, and disclaimer are all emitted in Chinese string literals, with no mechanism for the user to choose another language. This is a natural-language policy concern because the script enforces a single locale across all user-facing output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains natural-language documentation and output messages entirely in Chinese, including the module title and operational guidance, with no indication that the user can choose another language. Under the policy rule, forcing a specific language without user opt-in is a locale/language policy violation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/data_source.py (reported line 51)May include surrounding context.

python

"""通过curl获取JSON，带重试"""
    for attempt in range(retries):
        try:
            result = subprocess.run(
                ['curl', '-sL', '--connect-timeout', '10', '--max-time', str(timeout), url],
                capture_output=True, text=True, timeout=timeout + 5
            )

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains natural-language strings that define the skill’s purpose, usage, and output expectations exclusively in Chinese. Under the policy, a skill should not force a specific language or locale unless it offers opt-in or clearly documents a justified regional constraint; neither is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file is entirely written as a Chinese report template and instructs the agent to produce the final analysis in that format, including a colloquial prose summary. There is no indication that the user can choose another language or that the Chinese-only output is limited to a justified region-specific context, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file contains user-facing natural-language instructions exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. Under the language/locale policy, forcing a specific language without user choice can be a policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The top-level documentation describes a broader 'four-layer' data-source architecture and names Tushare MCP as part of it, while the actual functions in this file only attempt akshare, baostock, and Eastmoney-based retrieval. Although line 5 notes Tushare is called directly by the agent and not in this module, the docstring still overstates what this file itself does, creating a mild documentation-to-code mismatch.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This is a code file, so natural-language policy checks apply to docstrings and user-facing strings. The header, CLI description, help text, errors, and progress messages are all Chinese-only, which can violate a language/locale policy when no user opt-in or documented region-specific justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.