Security audit

A股量化工具包

Security checks across malware telemetry and agentic risk

Overview

This finance analysis skill is mostly purpose-aligned, but it needs review because some modules contain hidden automatic execution paths.

Review this skill before installing, especially if you use MSYS2/Windows Python environments. Its market-data network access is expected, but the hidden interpreter handoff, dynamic adjacent-file execution hook, and optional alert forwarding should be removed or explicitly documented and made opt-in.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The file performs an automatic interpreter handoff by invoking `C:/Python314/python.exe` via `subprocess.run()` whenever `msys64` appears in `sys.executable`, which is unrelated to the core backtesting function and happens before normal program logic. This creates an unexpected execution path that can run a different Python environment with different packages, permissions, or PATH behavior, reducing transparency and increasing the chance of unsafe or attacker-influenced execution if that interpreter or its environment is compromised.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The file presents itself as a market-monitoring script, but in the main block it also forwards generated alerts to a shared system knowledge bus via SystemBridge.monitor_notify_knowledge(). This hidden side effect expands the script's trust boundary and can cause downstream propagation of potentially sensitive or misleading trading signals without clear disclosure or user consent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The subprocess-based handoff occurs silently, with no warning, consent, or audit output explaining that execution is being transferred to another interpreter. In a finance/backtesting skill, this is more dangerous because users expect deterministic analytical behavior; silently switching runtimes undermines trust, complicates review, and can mask environment-based abuse or unexpected code execution.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The module dynamically reads and executes a companion script with exec() and also conditionally launches another Python interpreter via subprocess without any explicit disclosure. In a finance-related skill, hidden execution paths are especially risky because importing the module can trigger arbitrary code from adjacent files or unexpected process creation, which can be abused for persistence, evasion, or running unreviewed code.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: The skill silently performs outbound HTTP requests to third-party financial endpoints without any explicit user warning or consent flow. In an agent/skill context, undisclosed network access can leak user interest patterns, environment metadata, or trigger unexpected external communication, making this more sensitive than a normal local script.

Missing User Warnings

Medium

Confidence: 76% confidence
Finding: The code runs an external executable, curl.exe, without any warning to the user. In a skill execution environment, undisclosed execution of system binaries increases risk because it depends on host PATH/executable trust and may surprise users or platform operators with unexpected process spawning.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script automatically re-invokes a different Python interpreter when it detects msys64, then exits the original process. Silent interpreter switching is dangerous in a skill context because it changes the trust boundary, may bypass environment controls, and can execute under a different runtime than the caller expects.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: Real-time quote retrieval silently contacts an external service without any explicit notice. In an agent skill, hidden outbound requests are more dangerous because they may expose usage patterns or violate platform expectations around transparency and least surprise.

Ssd 4

High

Confidence: 98% confidence
Finding: The file contains concealed bootstrap logic that conditionally executes python_bridge.py via exec() and may re-launch execution through a hardcoded interpreter before the visible finance logic runs. This is dangerous because it creates a stealthy pre-execution hook in a financial-analysis module, allowing arbitrary code execution from a neighboring file while disguising itself as performance or environment setup.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.