Plan & Review

• Outcome: Review
• Latest audit: Sep 17, 2026 · 12:19 PM UTC
• Version: 1.1.0

Overview

This skill appears to generate Chinese market research reports from validated market snapshots without hidden, destructive, or credential-seeking behavior.

Install this only if you want a Chinese-language market-report workflow that writes local report evidence and depends on a separate market data skill. Do not expect it to create trading journals or discipline scores until the publisher aligns the description with the implemented features.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: 代码与声明有部分重合：它确实围绕盘前(pre)、午间/盘中(noon)、盘后(post)三阶段组织报告，并基于经过状态与 checks 校验的数据生成 bundle、要求证据引用、验证模板结构，这与“基于已校验市场数据生成盘前计划/复盘”基本一致。然而，声明中的重要功能“交易日志记录与纪律打分”在代码中完全没有体现。代码的 CLI 只有 capture、prepare、validate 三类操作，核心能力是市场数据快照采集、报告数据包组装和 markdown 报告校验，不包含日志创建/更新、纪律评分、用户交易行为分析等功能。此外，声明列出的触发词中相当一部分与“写日志/纪律打分”有关，而代码没有相应入口。故应判定为描述与实际行为存在实质性不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 声明描述的是一个面向终端用户的交易工作流技能，而实际提供的代码块仅是测试 derived_metrics 模块的单元测试，重点在市场情绪/恐慌贪婪指标与商品数据结构校验。两者主目的明显不同。虽然测试中涉及‘validated market data’，与声明中的‘已校验市场数据’有轻微关联，但这只是底层数据处理/验证，不足以支持所声明的核心能力。因此应判定为明显不匹配。

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares executable capabilities through its workflow instructions and required binaries, but does not define any explicit tool scope such as allowed-tools or permissions. That creates an over-privileged execution surface where shell, file read/write, and environment access may be available beyond what is minimally necessary, increasing the risk of unintended command execution or file modification.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list contains broad terms such as '复盘', '写日志', '今日计划', and '交易日志', which could activate the skill during ordinary conversation rather than a deliberate request for this workflow. Over-broad triggering can cause unintended execution of shell-backed preparation steps, unexpected file writes, or exposure of internal workflow behavior in unrelated contexts.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The skill description is written to operate in Chinese and names Chinese trigger phrases, but it does not indicate that language choice is optional or user-selectable. Under the policy, forcing a specific language without opt-in is a natural-language policy issue unless the locale constraint is explicitly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This file includes natural-language formulas, exception messages, and output labels in Chinese, such as the formula strings and later error/status text. Because the skill hard-codes a specific language without any opt-in or documented regional justification in this file, it matches the language/locale policy violation criteria.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file defines phase labels, required markdown headings, parser descriptions, and runtime error/help messages entirely in Chinese, which effectively forces a specific language for interaction and output. There is no indication of user opt-in, locale selection, or documented justification that this skill is intentionally limited to a Chinese-speaking context.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

command = [str(MARKET_PYTHON), str(MARKET_SCRIPT), dataset, "--date", day]
    for key, value in options.items():
        command.extend([f"--{key.replace('_', '-')}", str(value)])
    result = subprocess.run(command, cwd=ROOT, text=True, capture_output=True)
    if result.returncode:
        detail = "未知错误"
        try:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The entire template is written in Chinese, including the title and all section headers, which implies the skill will generate outputs in a fixed language. The file does not indicate any user opt-in, language selection mechanism, or documented justification for restricting output to Chinese.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The entire template is written in Chinese and defines all report headings and field labels in Chinese, which indicates the skill output is constrained to a specific language. There is no visible opt-in, language selection mechanism, or documented region-specific justification in this file, so it appears to impose a locale choice by default.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This code file contains natural-language expectations in Chinese for report content, and multiple assertions elsewhere require Chinese-only error strings and headings. Because the policy applies to all file types, hard-coding a single language without any opt-in or documented regional justification is a locale-policy concern.

Vague Triggers

Low

• Confidence: 84% confidence
• Finding: The manifest says to use "$plan-review to create the requested market report," but it does not define clearer trigger boundaries, exclusions, or examples of when the skill should not activate. While "$plan-review" is somewhat specific, the surrounding invocation description is still broad enough that users asking generally for a market report could ambiguously map to this skill.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This code performs file writes and overwrites via temporary-file replacement in `atomic_json`, and that helper is used to create or replace capture manifests, dataset snapshots, and bundle files. Although the implementation is commented for internal behavior, there is no user-facing warning, confirmation, or visible disclosure in this code that running the workflow will modify files under the skill data/report directories.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_derived_metrics.py:12

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_workflow.py:15