Security audit

Quant Trading Assistant

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malware, but it needs Review because it can give action-oriented stock guidance using under-disclosed fallback and sample data.

Review before installing if you might rely on it for real trading decisions. It queries public Tencent/Sina finance APIs and can output buy/sell-style guidance, but some results may be based on estimated or hard-coded data rather than complete live market and fundamental datasets. Treat outputs as educational analysis only and verify with a trusted financial data source.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises use of Tencent/Sina real-time market APIs and network-backed quote retrieval, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. That creates a mismatch between documented capabilities and declared execution boundaries, which can lead to unintended network access, weak reviewability, and over-privileged runtime behavior if the platform or host infers capabilities implicitly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are very broad: '问股票、分析行情、选股推荐、风险提示、技术指标计算' can match a wide range of normal financial conversations. This increases the chance of unintended invocation, causing the skill to activate in contexts where the user did not explicitly request automated trading analysis or recommendations, which is especially sensitive in a high-risk financial domain.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill content repeatedly steers toward concrete trading actions such as '买入/持有/卖出/观望', '打板介入', '追涨介入', and fixed stop-loss instructions, without meaningful opt-in constraints, suitability checks, or strong limitations on advisory use. In the context of retail stock trading, this makes accidental or overconfident reliance more dangerous because users may treat generated output as actionable investment advice rather than general analysis.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module title, docstrings, command output strings, and operational descriptions are entirely in Chinese, indicating the skill is designed to operate in a single language/locale. There is no visible user choice, opt-in, or explicit justification that this is a region-specific tool, so it conflicts with the policy against forcing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The fallback path claims to estimate indicators from real-time data but instead fabricates technical values using fixed multipliers and neutral placeholders. Because these values feed downstream signal generation and advice, users may receive apparently authoritative buy/hold guidance derived from invented analytics rather than actual market history.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill advertises quantitative stock screening but the screener operates on a fixed hard-coded candidate list rather than live or sourced market/fundamental data. In a trading assistant context, this can mislead users into treating stale, fabricated, or incomplete outputs as genuine investment screening, creating a material risk of financial harm from false decision support.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest description is written as a fixed Chinese-language description and specifically targets A-share market analysis, but it does not state that the skill is region-specific by design or offer any language/locale choice. This can violate language/locale policy when users are not informed that the skill is limited to Chinese-market context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill sends user-supplied stock symbols to external Tencent Finance infrastructure without disclosure. While the transmitted data is limited, undisclosed outbound requests can violate privacy expectations, enterprise policy, or regulated-environment constraints, especially when users assume analysis is local.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill makes an external request to Sina Finance for K-line data without informing the user that symbols and query parameters are sent off-system. In privacy-sensitive or controlled deployments, hidden outbound connectivity can create compliance and data-governance issues even if the payload is not highly sensitive.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.