A Stock Analyzer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:30 AM UTC
• Version: 2.2.0

Overview

This stock-analysis skill is review-worthy because it can produce and push actionable trading recommendations from silently substituted or inconsistent financial data.

Install only if you are comfortable reviewing the generated reports yourself before acting. Treat all recommendations as unverified analysis, disable or leave webhook push unconfigured unless you intend to send report content to that service, and prefer a pinned dependency environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/analyze.py:306

Finding

Fabricated Financial Data Can Be Used to Generate Investment Recommendations

Content

View full analysis

0 else None # 解析營收同比 (簡體中文) revenue_growth = None for col in df.columns: if '营业总收入' in col and '同比' in col and latest is not None: val = latest.get(col) if val and val != 'False': try: revenue_growth = float(str(val).replace('%', '')) except: pass break # 解析淨利潤同比 (簡體中文) profit_growth = None for col in df.columns: if '净利润' in col and '同比' in col and '扣非' not in col and latest is not None: val = latest.get(col) if val and val != 'False': try: profit_growth = float(str(val).replace('%', '')) except: pass break # 解析ROE (簡體中文) roe = None for col in df.columns: if '净资产收益率' in col and latest is not None: val = latest.get(col) if val and val != 'False': try: roe = float(str(val).replace('%', '')) except: pass break # 三年CAGR - 估算 profit_3y_ ...[truncated 4725 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/analyze.py:631

Finding

Risk Score Field Mismatch Produces Contradictory Risk and Position Guidance

Content

View full analysis

70: stop_profit_pct = int(stop_profit_pct * 0.8) # 如果波动大，放宽止损 if volatility > 8: stop_loss_pct = int(stop_loss_pct * 1.2) stop_loss = price * (1 - stop_loss_pct / 100) target = price * (1 + stop_profit_pct / 100) else: stop_loss = price * (1 - self.risk['stop_loss_pct'] / 100) target = price * (1 + self.risk['stop_profit_pct'] / 100) position = "重倉" if rank == 1 else ("中倉" if rank == 2 else "輕倉") position_pct = int(self.position_ratio[min(rank-1, len(self.position_ratio)-1)] * 100) # 计算综合评分 fin = stock.get('financial', {}) comprehensive_score = self.calculate_comprehensive_score(stock, tech, fin) # 分析买卖点 buy_sell = self.analyze_buy_sell_points(stock['symbol']) return { 'symbol': stock['symbol'], 'name': stock['name'], 'price': price, 'change_pct': stock['change_pct'], 'buy_range': f"{price * 0.98:.2f}-{price * 1.02:.2f}", 'target': f"{target:.2f} (+{stop_profit_pct}%)", 'stop_loss': f"{stop_loss:.2f} (-{self.risk['stop_loss_pct']}%)", 'position': position, 'position_pct': position_pct, 'comprehensive_score': comprehensive_score ...[truncated 3504 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:130

Finding

Third-Party Dependencies Are Installed Without Version or Integrity Pinning

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (43)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill metadata describes stock analysis, but the implementation also reads local configuration and sends outbound messages to Feishu/DingTalk webhooks. In this context, undisclosed messaging and local file access are more dangerous because they extend the trust boundary beyond market analysis into data handling and exfiltration-capable behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill metadata describes stock analysis, but the implementation also reads local configuration and sends outbound messages to Feishu/DingTalk webhooks. In this context, undisclosed messaging and local file access are more dangerous because they extend the trust boundary beyond market analysis into data handling and exfiltration-capable behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code claims to use real financial data but silently falls back to hardcoded defaults or simulated random-looking values when fetches fail or fields are missing. In a trading assistant context, this can mislead users into acting on fabricated metrics while believing they are factual, which is especially dangerous because the substitution is not clearly labeled as degraded or synthetic.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill advertises code-executing behavior with file read, file write, and network capabilities, but does not declare any tool scope or permissions boundaries. This creates an implicit trust problem: hosts or reviewers cannot easily assess or restrict what the skill may access, increasing the risk of unintended data exposure or outbound communication.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The entire report is presented only in Chinese and specifically framed around A-share market analysis, with no indication that language or locale selection is optional. Under the policy rule for natural-language violations, a skill should not impose a specific language or locale unless it is explicitly justified or user-selected.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The report goes beyond descriptive stock screening and provides concrete buy ranges, target prices, stop-loss levels, and a 60% position recommendation for a named security. In an agent skill described as an analysis/screening assistant, this materially increases the risk of users treating the output as actionable financial advice, which can cause concentrated losses and create compliance, suitability, and user-harm concerns.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The statement allowing a single stock allocation up to 60% reinforces concentrated portfolio advice that conflicts with the tool's stated analysis-focused purpose. Even with a risk disclaimer, this can encourage unsafe portfolio concentration and makes the skill functionally closer to an unvetted trading advisor than a screening assistant.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file is entirely written in Chinese and presents user-facing analysis and recommendations without any indication that language selection is optional or constrained by a documented regional requirement. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The report goes beyond stock screening and provides explicit buy ranges, target prices, stop-loss levels, and position sizing, which are actionable trading instructions rather than neutral analysis. In an agent skill context, this can mislead users into placing trades based on unverifiable or automated output, increasing financial harm and potential compliance risk despite the disclaimer.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The entire report is written in Chinese and specifically framed around A-share market analysis, but the file does not indicate that the user selected this language/locale or that the regional focus is intentionally constrained. Under the policy, forcing a specific language or locale without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The entire skill output is presented in Chinese, including headings, recommendations, and risk disclosures, without indicating that the user chose this language or that the skill is limited to a Chinese-language audience. This can violate language/locale policy when a skill unilaterally forces a specific language.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The report states it applies 7 strict screening conditions, but the disclosed technical metrics and recommendation outputs do not fully align with those criteria. In a stock-picking skill, this inconsistency can mislead users into believing recommendations were rigorously validated when they may have been produced from different or incomplete logic, increasing the risk of harmful financial decisions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The entire report is written in Chinese and specifically framed as an A-share market report, but the file does not state that the user requested this language/locale or that the skill is explicitly region-specific. Under the policy, forcing a specific language or locale without opt-in should be flagged unless the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire report is presented in Chinese, including headings, analysis labels, and risk disclosures, with no indication that the user opted into this language or that the skill is limited to a Chinese-language or China-region use case. The policy for this audit flags natural-language locale constraints when a skill appears to force a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire report is written in Chinese and tailored specifically to the A-share market context, with no indication that language or locale was user-selected or that the restriction is justified by a documented regional-only purpose. The policy requires flagging language or locale constraints when they are imposed without opt-in or clear justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire report is presented in Chinese, including headings, risk disclosures, and trading guidance, with no indication that the user opted into that language or that the skill is region-limited. This matches the policy category for language or locale constraints imposed without user choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is presented as a stock analysis/trading assistant, but it also transmits generated report content through a separate pusher module. This creates an unexpected data egress path that users may not anticipate, and because reports can contain configuration-derived outputs, market analysis, and potentially sensitive usage context, the hidden outbound behavior is security-relevant.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Report content is sent externally without explicit disclosure, confirmation, or consent. Even if the report seems non-sensitive, silent exfiltration violates user expectations and can leak derived analysis, stock selections, timestamps, and potentially environment-specific information through the external pusher integration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest frames the skill as an A-share analysis and stock-screening assistant based on trend and financial criteria. This file implements message delivery to Feishu and DingTalk via webhooks, which is a separate notification/integration capability rather than analysis or screening itself.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

Sending data to Feishu and DingTalk introduces an external communication capability. For a skill described only as a stock analysis and trading assistant focused on screening methodology, this outbound notification feature is not explicitly justified by the stated purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

This is a real external transmission sink: the function posts message content to a user-configured webhook. While expected for a push feature, it is still security-relevant because any sensitive report data included in the message leaves the local system and is exposed to the receiving service and anyone controlling that webhook.

Content

Scanner excerpt · scripts/pusher.py (reported line 59)May include surrounding context.

python

}
            }
            
            response = requests.post(webhook, json=card, timeout=10)
            
            if response.status_code == 200:
                print("✅ 飞书推送成功")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code sends report content to an external Feishu webhook without any in-code consent flow, masking, or disclosure at the point of transmission. If reports contain sensitive trading strategies, holdings, or proprietary analysis, they can be unintentionally shared to third-party services or misdirected if the webhook is wrong or compromised.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

This request posts analysis content to DingTalk, creating a clear outbound data flow to an external endpoint. In the context of a stock-analysis assistant, this can expose proprietary strategies or sensitive business information if users are unaware of the transmission or if the webhook destination is not trustworthy.

Content

Scanner excerpt · scripts/pusher.py (reported line 90)May include surrounding context.

python

}
            }
            
            response = requests.post(webhook, json=data, timeout=10)
            
            if response.status_code == 200:
                print("✅ 钉钉推送成功")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This path transmits report text to an external DingTalk webhook with no explicit disclosure or controls around what data leaves the local environment. In a financial-analysis context, that creates meaningful confidentiality risk because recommendations, watchlists, or internal commentary may be sent outside the expected processing boundary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The entire report is presented only in Chinese, including headings, recommendations, and risk notes, with no indication that the user opted into Chinese output or that the skill is region-locked. This can violate language/locale policy when a skill imposes a specific language without user choice or documented justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.