Security audit

Racing Quant AI 赛马量化AI选股系统

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a disclosed quant-analysis workflow, but it packages plaintext database credentials, live trading instructions, and production/admin runbooks that are too powerful for a stock-analysis skill.

Install only if you explicitly trust the publisher and intend to grant this skill access to remote strategy databases, external market-data services, and possibly trading/operations workflows. Rotate or remove the exposed database password, split live trading and production admin tasks into separate gated skills, and require explicit human confirmation and dry-run previews before any brokerage or server action.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (67)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill declares no permissions while clearly requiring network access to remote MySQL, market data providers, search services, and external APIs. This creates a transparency and control gap: operators and users cannot accurately assess what external connectivity the skill will use, which weakens review, sandboxing, and policy enforcement.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documented behavior goes materially beyond stock analysis into direct remote database access, schema inspection, local file export, broad historical scans, website debugging, and external command execution. This mismatch is dangerous because it hides powerful operational capabilities behind an innocuous analysis label, increasing the chance of overbroad invocation, excessive data access, or unsafe use in contexts where only advisory behavior was expected.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The skill extends from analysis into QMT trade generation and possible real order execution via xtquant. Crossing from recommendation to execution substantially increases risk because a mis-trigger, prompt injection, bad data, or user misunderstanding can translate directly into unauthorized or harmful trades.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: Including website debugging and modification under a stock-picking skill broadens the privilege boundary far beyond the stated purpose. That makes accidental activation for general engineering tasks more likely and could expose application, API, or database internals through a skill users would not reasonably expect to have maintenance capabilities.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Direct trade execution through scripts and xtquant is not a natural extension of a research/reporting skill and creates a high-impact action surface. In this context, the danger is amplified because the same workflow already touches remote data, portfolio state, and automated instruction generation, so a single misuse path can lead to real financial loss.

Context-Inappropriate Capability

Medium

Confidence: 80% confidence
Finding: Instructions about inspecting or interacting with cronjob prompts and production job state are unrelated to stock analysis and expose operational control-plane knowledge. Even though framed as cautionary guidance, embedding production-job handling in this skill expands the blast radius and could facilitate accidental prompt overwrites, job tampering, or leakage of sensitive scheduled-task content.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The document gives concrete operational instructions for accessing a production server, restarting services, inspecting logs, checking ports, and testing internal APIs. For a stock-selection skill, these deployment and infrastructure capabilities are unnecessary and materially expand the agent’s ability to perform administrative actions outside its intended scope. Because the same file also contains live environment details and adjacent credential material, this operational guidance becomes more dangerous in context.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The file documents clone, branch, commit, and push workflows for a private repository, including agent-specific Git identity configuration. That grants an analysis-oriented skill unnecessary software supply-chain write guidance, which could enable unauthorized code changes or repository tampering if an agent is induced to act on it. In this skill context, source-control write access is unrelated to stock recommendation functionality and therefore unjustified.

Context-Inappropriate Capability

Critical

Confidence: 100% confidence
Finding: The document exposes direct production access details, including a public server IP, remote MySQL host, username, and plaintext password, plus command examples that use them. This is a severe secret leakage issue: anyone with access to the skill content could reuse the credentials to query or modify sensitive systems, pivot into broader infrastructure, or exfiltrate proprietary financial data. The fact that this appears inside a stock-selection skill makes it especially dangerous because the credentials are unrelated to the advertised purpose and therefore have no legitimate reason to be present.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The workflow materially expands the skill from strategy/database-based stock screening into end-to-end portfolio analysis with explicit buy/sell recommendations. That scope expansion increases the chance the agent will perform higher-risk financial advising actions beyond the declared user expectations and manifest boundary, which can mislead users and bypass governance controls tied to the original skill purpose.

Description-Behavior Mismatch

Low

Confidence: 81% confidence
Finding: The workflow introduces ETF-specific analysis although the skill description centers on stock selection and individual stock recommendation analysis. While not inherently malicious, this broadens the instrument coverage beyond the declared scope and can cause unauthorized or poorly governed advice generation for assets the skill was not explicitly designed to handle.

Context-Inappropriate Capability

Low

Confidence: 76% confidence
Finding: The instruction to use general web search extends the workflow beyond the stated quant/database analysis purpose and introduces a less controlled data acquisition path. General web search can pull unverified or manipulated financial content, increasing prompt-injection, misinformation, and provenance risks in an investment-analysis context.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill instructs users to upload generated reports to Feishu using another skill and credentials loaded from the environment, which expands the skill from local quantitative analysis into external data exfiltration. Because the reports are built from full historical holdings and backtest outputs, this creates a real risk of sending sensitive trading or proprietary strategy information to a third-party platform without explicit consent or scope restriction.

Context-Inappropriate Capability

Medium

Confidence: 78% confidence
Finding: The documentation mandates use of subprocess.run with curl for network retrieval, introducing shell-tool execution capability where ordinary HTTP client behavior would suffice. Although the example uses argument-list invocation rather than shell=True, it still broadens operational power, increases attack surface, and normalizes external command execution inside a skill whose primary purpose is financial analysis.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file documents a pipeline that converts strategy holdings into actual QMT orders, which materially exceeds the stated skill purpose of stock selection and investment reference. Embedding live trade-execution instructions inside an analysis-oriented skill creates a dangerous capability escalation: a user invoking an analytical skill could be led into automated brokerage actions without clear separation of responsibilities or safeguards.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The documented modes include 'execute' and 'full', both of which can place real orders through xtquant, including a one-step flow from strategy selection to live execution. For a skill described as recommendation and analysis, this is a direct-action financial capability that could cause unauthorized or insufficiently reviewed trades, especially if invoked by an agent or integrated workflow.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The architecture explicitly relies on external market-data APIs and database connectivity as operational components of a trading pipeline, not merely research support. In the context of an analysis skill, this broadens the blast radius by enabling live data-driven trading behavior and remote dependency access, which increases the chance of unintended execution, data misuse, or brittle automation decisions.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The documented repository scope significantly exceeds the skill's declared purpose of strategy screening and stock analysis, including ETL, timing strategies, backtesting, monitoring, and operational workflows. This kind of capability mismatch increases the risk that the agent can access or expose functions users and reviewers did not expect, undermining least-privilege and informed consent.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Operational portfolio rebalancing logic goes beyond passive analysis and can enable action-oriented trading behavior such as buy/sell selection and position changes. In an analysis-branded skill, this hidden expansion of authority is dangerous because it can be invoked without users clearly understanding that the system contains execution-adjacent decision logic.

Description-Behavior Mismatch

Medium

Confidence: 99% confidence
Finding: The script contains a hard-coded remote MySQL connection, including credentials and a public IP, and directly accesses an external database. In the context of an investment-analysis skill, embedding operational database access in source code materially increases the risk of credential theft, unauthorized access, and data exfiltration if the repository or package is exposed.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script prints the full database row contents to stdout, which can expose sensitive or proprietary fields beyond what is needed for troubleshooting. If logs are collected, shared, or persisted, this creates a secondary leakage path for data retrieved from the remote database.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The script contains a built-in capability to connect directly to a production-like MySQL host and inspect table schema, which exceeds a narrow end-user stock-selection function and exposes internal database structure. Even though the current query is fixed to DESCRIBE a single table, embedding direct inspection logic in a distributed skill increases the risk of unauthorized reconnaissance and later abuse if the code or credentials are reused.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The script embeds direct access to a remote MySQL database using hardcoded credentials and then enumerates strategy metadata from the full strategy_information table. Even if intended for stock analysis, this grants broader backend access than is necessary for a narrow analysis task and creates unnecessary exposure if the script is reused, leaked, or invoked outside the expected workflow.

Description-Behavior Mismatch

Medium

Confidence: 73% confidence
Finding: This section performs a database-wide query of all recommended strategies and prints each strategy's latest top holdings, which goes beyond a focused check for one stock code. In the context of an investment-analysis skill, that broad reporting can expose proprietary strategy positions or internal recommendation data to any caller able to run the script.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This script connects directly to a production-style MySQL database, extracts historical strategy holdings, and writes the full dataset to a local JSON file under /tmp. Even if intended for debugging, this creates an unauthorized data export path outside the described stock-selection workflow, increasing the risk of sensitive strategy data leakage, redistribution, or misuse.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/get-positions-correct.js:41