stock-scheme-tracker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:11 AM UTC
• Version: 1.1.0

Overview

The skill has a coherent stock-strategy tracking purpose, but its save script can modify any agent-writable path while the documentation overstates its path-validation and atomic-write protections.

Review this before installing if your agent may run skills automatically or follow untrusted prompts. Configure STOCK_SCHEME_PATH only to a dedicated Markdown file, avoid passing arbitrary --path values, and treat the documented path-validation and atomic-write claims as not implemented in this version.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/save_scheme.py:190

Finding

Unrestricted File Destination Allows Modification of Arbitrary Writable Files

Content

View full analysis

最后更新：\d{4}-\d{2}-\d{2}", f"> 最后更新：{today}", content ) scheme_path.write_text(content, encoding="utf-8") ``` The destination is also created without validating its type or location: ```python def ensure_file(scheme_path): """Ensure scheme.md exists with proper header.""" scheme_path.parent.mkdir(parents=True, exist_ok=True) if not scheme_path.exists(): header = f"""# 股票策略跟踪 > 最后更新：{datetime.now().strftime('%Y-%m-%d')} """ scheme_path.write_text(header, encoding="utf-8") ``` ### Technical Analysis The script accepts a destination from either `--path` or `STOCK_SCHEME_PATH` an ...[truncated 2705 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description advertises generic trigger terms including 'scheme' and 'stock strategy,' which are common conversational phrases and may overlap with unrelated user requests. This broad trigger surface increases the chance the agent auto-selects the skill in contexts where the user did not intend file reads/writes or strategy tracking behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The save-mode trigger text includes broad phrases such as 'or any variant,' which can cause the agent to invoke the skill on loosely related conversational input. In this skill, that can lead to unintended persistence of sensitive investment analysis into a local file without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The check-mode trigger section also uses broad phrasing ('or any variant'), making accidental activation more likely during ordinary discussion about stocks or strategies. Because check mode reads a user-specific local tracking file and may trigger web/tool lookups, unintended invocation can expose private portfolio strategy context to other tools or produce actions the user did not request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The troubleshooting guidance tells users to set LANG to specific locales ("en_US.UTF-8" or "zh_CN.UTF-8") without presenting this as a user choice or explaining locale implications. This is a natural-language locale policy issue because it directs a system language/locale change rather than offering an opt-in preference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This Python file contains multiple user-facing strings in Chinese for generated reports, errors, and summaries. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or a documented locale-specific justification is a reportable issue.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module docstring states there are only two modes, parse and report, and the argument parser only implements --parse and --report. However, the default-path error message tells users to 'use save mode to save strategies,' which describes a capability this script does not provide.

Content

No source excerpt is available for this finding.