Security audit

Backtest Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This skill locally analyzes user-provided trading CSV files and shows no network access, hidden persistence, or credential handling, though its docs are narrower than the code.

Install only if you are comfortable giving the skill access to local trade CSV files you choose. Use explicit input and output paths, review generated reports before relying on them financially, and note that some advanced analysis features are documented in the script more than in the main skill description.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: A description-behavior mismatch is security-relevant because users and calling agents may authorize the skill based on the narrow documented purpose, while the implementation reportedly performs broader analytics such as benchmark comparison and attribution analysis. Hidden or undocumented behaviors undermine informed consent and can expand data processing beyond what the user expects, especially for sensitive financial records.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises local CSV analysis and JSON export, which inherently requires file read/write capability, but it does not explicitly declare tool scope such as permissions or allowed tools. This creates an authorization ambiguity: an orchestrator may grant broader file access than intended, increasing the chance of unintended access to local files beyond the user-provided CSV/report path.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description, usage cues, and trigger keywords are presented in Chinese with no indication that users may interact in another language or choose their preferred locale. Under the policy, language constraints should be optional or explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The listed triggers include broad phrases like '策略评估' and '交易统计', which could match many ordinary conversations about trading rather than specifically requesting this CSV backtest-analysis skill. The description does not provide exclusion conditions or negative examples to clarify when the skill should not activate.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest describes a local tool for calculating core metrics from trade CSVs and exporting JSON, but this file adds substantial extra behaviors: monthly/quarterly decomposition, stock/sector attribution, benchmark comparison, frequency analysis, streak statistics, and one-line strategy rating. These are not just implementation details of the listed v1.0.0 metrics; they expand the skill’s functional scope beyond what the manifest says it does.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The changelog content is entirely in Chinese, including the title and section text, with no indication that users can choose another language or that the skill is region-specific. This can violate language/locale policy when a specific language is imposed without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The user-facing documentation switches into Chinese for the primary usage and feature descriptions ('快速开始', '功能', '回测分析工具'). This is a natural-language locale choice presented without opt-in or justification, which can violate language/locale policy for general-purpose skills.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This manifest contains user-facing natural-language fields in Chinese, including the package description and several keywords, which effectively constrain the skill's language/locale without an explicit user opt-in. Although the manifest includes a CN region field, it does not clearly document that the skill is intentionally region-specific or provide a language choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This Python file contains its top-level description, CLI help text examples, and later user-facing strings in Chinese, but does not indicate that the tool is region-specific or provide any opt-in language selection. That creates a natural-language locale policy issue because the skill effectively enforces one language for all users.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The docstring says the function performs '交易频率分析（间隔分布、持仓时间）', implying actual holding-time analysis. However, the implementation later notes it is only a simplified estimate based on first and last dates seen for each stock, which can differ materially from true holding periods derived from matched opens/closes.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.