Security audit

Stock Planner

Security checks for vulnerabilities and agentic risk

Overview

This stock-planning skill runs locally and shows no malicious code, but it under-discloses broader financial-analysis features that could influence trading decisions.

Review before installing if you do not want a skill to process portfolio files or provide trading, rebalancing, correlation, history, or leverage guidance. It appears local-only and non-persistent, but users should treat its output as financial analysis, verify commands carefully, and avoid giving it broader files than intended.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: A description-behavior mismatch is security-relevant because users may authorize or invoke the skill expecting only simple next-day planning, while the implementation reportedly also handles plan comparison, rebalancing, correlation analysis, historical review, and margin/leverage risk assessment. Hidden or undocumented behaviors expand the data surface and decision authority of the skill, which can lead to unsafe financial recommendations or unexpected processing of additional files.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises local-only behavior and mentions reading positions plus optional JSON output, but it does not explicitly declare tool scope such as file read/write permissions. That makes the effective capabilities ambiguous to the host and users, increasing the risk of over-broad file access or unintended writes if the skill is invoked in a more privileged environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language description, usage cues, and trigger wording are entirely in Chinese, which implies a fixed language expectation for the skill. There is no statement that the user may choose another language, nor any documented justification that this is a China-specific or Chinese-only compliance tool.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Broad trigger keywords with no activation constraints can cause the skill to activate in loosely related finance conversations, exposing portfolio data handling and recommendation generation when the user did not clearly request it. In a trading context, accidental invocation is more dangerous than in a generic utility because it may influence high-impact financial decisions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest describes a local CSV-based tool for generating next-day buy/sell suggestions, position risk checks, stop-loss/take-profit checks, and position control. The module docstring and implemented subcommands expand that scope into multi-plan comparison, portfolio rebalancing, historical review, correlation analytics, and margin/leverage risk assessment, which are materially broader capabilities than the stated skill purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language descriptions, help text, and operational output in Chinese only, starting from the module docstring and continuing through the CLI usage examples. Because the skill does not offer a user opt-in or alternative locale, it effectively forces a specific language, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The user-facing headings and feature description are written in Chinese, and the document does not offer any language choice or explain that the skill is intended only for a Chinese-speaking or region-specific audience. This can conflict with organizational language/locale policy when a skill implicitly forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The top-level documentation shows usage such as 'python3 scripts/stock_planner.py --positions pos.csv', suggesting plan generation is the default action. But the parser requires a subcommand and only defines 'plan' as a named subparser, so the documented invocation will not work as written.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This is an active contradiction between the file's own documentation and runtime behavior. The docstring presents direct invocation as valid usage, while the code at argument parsing enforces a required subcommand and therefore rejects that form.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.