Security audit

Justice Plutus

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local wrapper for a stock-analysis tool, with purpose-aligned optional external data, LLM, and notification integrations.

Install only if you are comfortable running a local stock-analysis pipeline that uses your configured LLM and market-data credentials. Use report-only mode when you do not want notifications, and review which provider keys or webhooks are set in your environment before enabling enrichment or notification modes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill advertises optional Feishu/Telegram notifications and multiple third-party enhancement providers, but it does not clearly disclose that stock codes, report content, or derived analysis may be sent off-host when these features are enabled. This creates a transparency and data-leakage risk because users may assume the workflow is fully local-first while optional integrations can transmit potentially sensitive inputs or outputs to external services.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrase "dry run" is generic and likely to collide with ordinary user requests unrelated to this skill, increasing the chance of accidental invocation. In an agent ecosystem, broad triggers can cause unintended execution of local scripts and downstream data access without the user clearly intending to use this stock-analysis skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The overview states that notifications can send results through Feishu, Telegram, and other configured channels, but it does not present this as a clear data-transmission warning to the operator. Because analysis outputs may include stock selections, generated summaries, and possibly enriched third-party data, an unsuspecting user could enable notification mode without fully understanding that report contents leave the local machine.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The wrapper blocks execution unless a generic external LLM API key is present, despite the skill being described as local A-share analysis with only optional external enhancements. This creates an undisclosed dependency on third-party AI providers and can cause users to expose credentials or route sensitive stock symbols, prompts, analysis context, or generated reports to remote services contrary to their expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file documents output paths under reports/ but does not clearly warn that multiple Markdown, JSON, and metadata artifacts will be written to local storage for each run. This can expose sensitive trading research, prompts, or run metadata to other local users, backups, sync tools, or accidental commits if operators assume the skill is read-only.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.