Security audit

A股(机构主力)股指期货持仓统计-中金所

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent finance-reporting helper that fetches public CFFEX position data and writes local cache/report files, with some integrity and invocation cautions but no evidence of hidden or harmful behavior.

Install only if you want a local skill that contacts CFFEX, caches downloaded XML files beside the skill, and writes an HTML report in the current working directory. Treat the generated report as unauthenticated public market data and not investment advice; the TLS handling should be improved before relying on the data for high-stakes decisions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs the agent to perform network access to cffex.com.cn and to write HTML output and cache files, yet no explicit permissions or capability declarations are documented. This creates a trust gap where users or hosting platforms may not realize the skill can reach external resources and modify the filesystem, increasing the chance of unintended data access, unexpected writes, or policy bypass in environments that rely on declared permissions.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The script explicitly disables certificate validation and hostname verification for HTTPS requests, which would allow a man-in-the-middle attacker to tamper with downloaded market data without detection. In this skill’s context, the fetched data is used to generate reports and trading-position summaries, so integrity matters even if there is no direct code execution.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The trigger phrases are broad everyday requests such as '统计今日股指持仓' and similar natural-language variants, which can cause the skill to activate unexpectedly. Because activation leads to network fetches and file generation, a false trigger can produce unintended external requests and local writes without the user intentionally invoking this exact skill.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The skill claims it can be auto-invoked from generic natural language without defining boundaries, increasing the risk of overbroad matching and unintended execution. In this context, unintended execution is meaningful because the skill is not read-only: it downloads remote data, creates cache directories, and writes HTML reports to the current working directory.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: if_netchange.py:46