Security audit

Stock Screener

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local stock-screening skill, but users should be careful with untrusted CSV inputs and spreadsheet exports.

Install only if you are comfortable with a local CSV-based stock analysis tool. Use it with CSV files you trust, treat outputs as analysis rather than investment advice, and avoid opening exported CSVs from untrusted inputs in spreadsheet software unless formulas are disabled or sanitized.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: `, or - `rank --output <file>`. 4. The application copies the malicious cell unchanged into the generated CSV. 5. The user opens the exported CSV in a spreadsheet application. 6. The spreadsheet interprets the cell as a formula. 7. Depending on available spreadsheet functions and security controls, the formula may initiate external network requests, expose spreadsheet-accessible data, present misleading content, or invoke other application-specific behavior. ### Impact Assessment The Python process its ...[truncated 838 chars]:200
Finding: Spreadsheet Formula Injection in Exported CSV Files
Content: View full analysis
`, or - `rank --output `. 4. The application copies the malicious cell unchanged into the generated CSV. 5. The user opens the exported CSV in a spreadsheet application. 6. The spreadsheet inte ...[truncated 1027 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documentation is written entirely in Chinese, including headings, usage guidance, and safety/legal notes, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only regional context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises local file-based workflows and example commands that read input CSVs and write output CSVs, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity: a host agent may grant broader file access than users expect, increasing the chance of unintended file reads or writes if the skill is invoked in a larger automation context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger list includes broad generic terms like “筛选”, “scan”, and “multi-factor”, which can match ordinary financial discussion rather than a clear request to run this specific skill. In an agent system, overly broad activation can cause the skill to process unintended user content or local files, especially because the skill supports file read/write workflows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This Python file contains user-facing natural-language content such as the module description, usage guidance, errors, help text, and disclaimer exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The command functions are implemented and documented with differing parameter lists: cmd_filter accepts (rows, col_map, headers, args), while cmd_rank/cmd_score/cmd_summary/cmd_correlation are defined for fewer arguments. At L799, the dispatcher unconditionally invokes every handler as commands[args.command](rows, col_map, headers, args), which contradicts those function definitions and causes non-filter commands to fail at runtime instead of performing the advertised ranking, scoring, summary, or correlation behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This markdown file contains multiple user-facing changelog entries entirely in Chinese, including feature descriptions and disclaimer references, without any indication that language selection is optional. Under the policy rule for language/locale, this can be read as a fixed language choice rather than offering users a choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest description and usage guidance are presented primarily in Chinese with some English terms, but there is no indication that the user can choose their preferred language or locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This manifest contains user-facing natural-language content only in Chinese, which can impose a language requirement without explicit user opt-in. The policy scope allows flagging language or locale constraints when they are forced and not documented as optional or region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Line L1 uses Chinese text to communicate a requirement note, which can constitute a language/locale policy issue when the skill does not offer a user language choice or explain a required locale constraint. The file provides no indication that Chinese is optional or justified by a region-specific purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.