Security audit

China A Stock Trader

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a disclosed Chinese A-share analysis helper, not malware, but its stock advice depends on external data and can fall back to example data.

Install only if you want Chinese-language A-share analysis and are comfortable with outbound market-data queries. Treat all buy/sell outputs as informational, verify data freshness and source quality yourself, do not trade from mock fallback records, and install dependencies from a pinned, reviewed environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: a_stock_trader.py:341
Finding: Unpinned Third-Party Dependency Installation Recommendation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: a_stock_trader.py:338
Finding: Fabricated Financial Records Returned After Data Retrieval Failures
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill advertises and demonstrates network-backed market data access (e.g. 腾讯/新浪 API, akshare) but does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and governance gap: an agent may invoke network-capable behavior without a clearly bounded contract, making review, runtime enforcement, and least-privilege application harder.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description and trigger scope are broad enough to match ordinary stock-market conversations such as asking about a stock, market conditions, or risk prompts. Ambiguous invocation boundaries can cause the skill to auto-activate in contexts the user did not intend, exposing network/tool use and generating high-risk financial recommendations without a clear opt-in boundary.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The example phrases are generic conversational requests that overlap heavily with routine user dialogue, increasing the chance of unintended skill invocation. In a financial-trading context, accidental activation is more dangerous because it may trigger external data access and produce actionable buy/sell guidance in situations where the user only sought general information.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module description and all user-facing guidance are written exclusively in Chinese, and later outputs such as trading advice and risk messages are also hard-coded in Chinese. For an all-file policy check, this is a natural-language locale constraint without user opt-in or an explicit statement that the skill is intentionally limited to Chinese-speaking users for a justified regional purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill performs outbound requests to third-party market data endpoints without explicit user disclosure or consent. In an agent environment, this can leak user-supplied stock symbols, timing, and usage patterns to external services, creating privacy and supply-chain exposure even if the requests are functionally expected.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The docstring says the function performs fundamental screening using ROE minimum, growth minimum, and debt maximum thresholds, and the signature exposes those parameters. In code, only PE, PB, and turnover are actually used for filtering, so the documentation actively misrepresents what screening is being performed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Dynamic import and use of akshare causes indirect third-party network access that is not visible to the user and may pull data from multiple upstream sources. This increases privacy, provenance, and dependency risk because requests and data flows are delegated to a library outside the immediate codebase.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes the skill specifically as '中国A股实战分析Skill' focused on A-shares. However, this function explicitly retrieves '美股/港股信息' via Yahoo Finance, expanding the behavior beyond the stated A-share scope rather than supporting the declared A-share functionality.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script's printed headings, labels, and advice fields are entirely in Chinese, creating a fixed locale experience for users. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest text is entirely in Chinese and presents the skill as a China A-share analysis tool without indicating any language choice or opt-in. Under the policy rule for natural-language violations, forcing a specific language/locale without user opt-in should be flagged unless clearly documented as a justified regional constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.