Back to skill

Security audit

A股三层选股模型

Security checks for vulnerabilities and agentic risk

Overview

This A-share stock-picking skill is not malicious, but it can produce precise trading recommendations while its implemented screener does not enforce several safeguards it claims to use.

Review before installing. This skill appears intended for A-share screening and does not show malware behavior, but users should not rely on its output as vetted investment advice because the code does not implement several safeguards promised in the documentation and may present incomplete scans as actionable stock picks.

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/screen.py:10
Finding

Documented Financial-Risk Controls Are Not Implemented

Content
View full analysis
ma15: trend += 0.5 if ma15 > ma60: trend += 0.5 # MACD近似 macd_s = 0.3 if gain5 > 3 else (0.1 if gain5 > -3 else 0.0) # 量比 avg_v = sum(vols[-5:]) / 5 vr = vols[-1] / avg_v if avg_v > 0 else 1.0 vol_s = 1.0 if vr >= 1.3 else (0.5 if vr >= 0.8 else 0.0) # 涨幅过滤 gain_s = 1.0 if gain5 >= 1 else (0.5 if gain5 >= 0 else 0.0) total = trend * 0.30 + macd_s * 0.25 + vol_s * 0.20 + gain_s * 0.25 ``` ```python if scored["total"] >= THRESHOLD: results.append(scored) ``` ```python stocks = [ {"code": s["symbol"], "name": s["name"], "price": float(s.get("trade", 0) or 0), "change_pct": float(s.get("changepercent", 0) or 0), "turnover": float(s.get("turnover", 0) or 0)} for s in raw if s.get("name") and "ST" not in s.get("name", "") and 0 < float(s.get("trade", 0) or 0) < 500 and not s.get("symbol", "").startswith("bj") ] ``` ### Technical Analysis The Skill documentation states that the quantitative screening stage enforces market-capitalization limits and evaluates five equally weighted dimensions: market capitalization, trend momentum, five-day average turnover, MACD, and chip distribution. It also documents hard exclusions based on listing age, profitability, debt, and other ...[truncated 3276 chars]
Remediation
View remediation
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger phrases are broad and map to common requests like '选股' or '扫描市场', so the skill may auto-activate in many ordinary finance conversations without the user clearly opting into this workflow. In a stock-picking skill that produces concrete recommendations, overbroad invocation increases the chance of unsolicited financial advice, misuse of tools, and bypass of safer, more contextual handling.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill invokes external data sources and a Python screening script but does not declare any explicit tool scope or permissions boundaries. That creates an authorization and governance gap: an agent may use network-capable tools more broadly than intended, making data exfiltration, unreviewed outbound requests, or unexpected tool use harder to control and audit.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to output precise buy ranges, stop losses, targets, and position sizing, but it does not include a visible warning that the content is informational only and not personalized financial advice. This is risky because users may rely on the output as actionable investment guidance despite missing suitability checks, uncertainty disclosures, and jurisdictional compliance safeguards.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all instructions and criteria exclusively in Chinese, with no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file contains user-facing instructions exclusively in Chinese, and there is no indication that the skill is region-specific or that users may opt into another language. Under the policy rule for natural-language violations, forcing a specific language without user choice is a reportable issue.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The user-facing banner at L141 states a market-cap scope of 50~500亿, implying this quantitative screener filters candidates by market capitalization. However, the actual stock filtering logic at L147-L156 only filters by name, price, and symbol prefix; the MARKET_CAP_MIN and MARKET_CAP_MAX constants are never used, so the documented intent contradicts runtime behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This Python file contains natural-language descriptions entirely in Chinese alongside Chinese-only runtime messages, indicating the skill is intended to operate in a fixed language/locale. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.