Financial Advisor

• Outcome: Review
• Latest audit: May 28, 2026 · 2:21 PM UTC
• Version: 1.0.0

Overview

This financial-analysis skill mostly matches its purpose, but it needs Review because it includes an unexplained encrypted backup file, automatic dependency installation, broad network collection, and high-impact investment recommendations.

Install only after reviewing or removing the encrypted backup file, and run the skill in an isolated Python environment. Expect it to contact many third-party financial, news, and social/trend sources, install Python packages if missing, write local report files, and generate specific investment recommendations that require independent verification and should not be treated as personalized financial advice.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (30)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def install_package(package_name, version):
    """安装指定版本的包"""
    try:
        subprocess.check_call(
            [sys.executable, '-m', 'pip', 'install', '--quiet', f'{package_name}>={version}'],
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL

• Confidence: 95% confidence
• Finding: The script spawns a pip subprocess to install packages at runtime, which introduces code execution and supply-chain risk because it downloads and installs code from package indexes without explicit user approval. Even though arguments are passed as a list and there is no obvious shell injection, automatic package installation is still dangerous in an agent skill because it performs unexpected system modification and network access.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs the agent to use shell commands, local file writes, and networked Python scripts, but it declares no permissions or user-facing constraints. That mismatch can cause the agent to perform sensitive actions implicitly, reducing auditability and informed consent for network access and filesystem modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence
• Finding: The documented purpose is financial analysis, but the behavior expands into dependency installation, execution validation, broad trending scraping across unrelated platforms, and prompt generation for external search. This gap increases the risk that the skill performs unexpected actions beyond user intent, including broader network activity and environment modification.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The guide explicitly instructs collection of broad political and current-affairs intelligence across many platforms, which materially expands the skill from financial analysis into generalized news and political surveillance. That scope expansion increases the chance of unnecessary data collection, off-mission behavior, and generation of sensitive geopolitical/policy analysis unrelated to the user's financial request.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The macro-analysis documentation says all trending topics are classified into 13 categories 'not limited to finance,' including geopolitical and general events. This creates a clear mechanism for broad non-financial intelligence processing inside a financial-advisor skill, enabling mission creep and potentially exposing users to unauthorized or irrelevant political profiling content.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script is designed to collect broad cross-platform trending and public-opinion data, including general social and political topics, which materially exceeds the stated scope of a financial-advisor skill. In this context, the mismatch increases risk of unauthorized data collection, surveillance-like use, and repurposing the skill for non-financial intelligence gathering.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code explicitly supports entertainment, sports, youth culture, and consumer-culture sources such as Hupu, Bilibili, Douyin, and Douban without a clear financial-analysis necessity. That over-collection broadens the skill beyond its declared purpose and makes it easier to profile public sentiment or gather unrelated behavioral intelligence under the cover of a finance tool.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The script generates specific buy/sell/hold signals, target prices, stop-losses, and execution steps while also stating that it is not investment advice. In a financial-advisor skill, this mismatch can mislead users or downstream agents into treating regulated advisory content as merely informational, increasing legal/compliance risk and the chance of unsafe financial decisions.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The script directly concatenates untrusted content from AI analysis JSON, news/title fields, macro/global context, stock names, and other data sources into HTML fragments without escaping. Because the generated report also loads JavaScript and is intended to be opened in a browser, a malicious title or AI/news payload can inject arbitrary HTML/JS, leading to stored XSS in the generated report and possible local data exposure or unauthorized actions in the viewer's browser context.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: This setup script performs package installation via pip, which is a privileged operational capability beyond normal financial analysis and increases the attack surface of the skill. In the context of an agent skill, hidden dependency installation can lead to unreviewed code being fetched and executed, making supply-chain compromise or unauthorized environment changes possible.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The invocation description is broad enough to trigger on many ordinary finance questions, which can cause unnecessary activation of a high-capability workflow involving network access, shell execution, and file generation. Overbroad routing increases the chance of excessive data collection and actions the user did not specifically request.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The condition 'when the user requests analysis of a stock/ETF/fund' does not define limits on depth, data sources, or whether file/network operations are allowed. In this context, ambiguity is risky because the skill can escalate from a simple question into a full pipeline with scraping, searches, and local artifact generation.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill advertises extensive data collection, web search, and report generation without warning that it will access external services and write multiple local files. Users and operators may be unaware of privacy, compliance, or storage implications, especially in shared or regulated environments.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill provides concrete trading recommendations, price targets, stop-losses, and position-sizing guidance without a user-facing financial-risk disclaimer or jurisdictional limitations. This can mislead users into treating generated output as regulated financial advice and increases legal and safety risk, especially because the skill presents itself as professional and institutional-grade.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The example explicitly instructs generation of investment recommendations, target prices, stop-loss values, and HTML reports that could be consumed as actionable financial advice, yet it provides no warning, suitability check, or disclaimer. In a financial-advisor skill, this omission is more dangerous because the surrounding context gives the output an institutional and authoritative tone, increasing the chance that users rely on it for real-world financial decisions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The file includes specific investment recommendations, target price, stop-loss, and portfolio allocation guidance without any suitability disclaimer, risk warning, or instruction to verify assumptions with current data and user circumstances. In a financial-advisor skill, this is more dangerous because users are likely to rely on the content as actionable personalized advice, increasing regulatory, consumer-harm, and mis-selling risk if the examples are stale or inappropriately generalized.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The file begins entirely in Chinese and the framework repeatedly uses mandatory language such as '必须', creating an effective requirement that outputs and workflow follow Chinese-only instructions without any user language-choice mechanism. This can degrade safety and usability by preventing users or downstream reviewers from understanding critical financial analysis content, disclaimers, and generated reports, especially in multilingual environments.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script automatically performs network-backed package installation without advance consent, which is risky because it causes side effects outside the stated user task and may import untrusted code into the environment. In a financial-advisor skill, this behavior is less justified because package management is unrelated to end-user financial analysis and should not occur silently at first use.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

yfinance>=0.2.36
pandas>=2.0.0
numpy>=1.24.0
matplotlib>=3.7.0

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower bound only (yfinance>=0.2.36), which allows installation of any future version, including unreviewed breaking or compromised releases. This weakens supply-chain reproducibility and makes builds harder to audit, though it is not an immediate exploitable flaw by itself.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

yfinance>=0.2.36
pandas>=2.0.0
numpy>=1.24.0
matplotlib>=3.7.0
plotly>=5.18.0

• Confidence: 95% confidence
• Finding: Using pandas>=2.0.0 permits any later version to be installed, which creates supply-chain and reproducibility risk if a future release introduces a vulnerability or malicious code. In a financial analysis skill that processes external market data, predictable dependency resolution is important for trust and stability.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

yfinance>=0.2.36
pandas>=2.0.0
numpy>=1.24.0
matplotlib>=3.7.0
plotly>=5.18.0
scipy>=1.11.0

• Confidence: 95% confidence
• Finding: numpy>=1.24.0 is not fully pinned, so the environment may resolve to any later release. That increases exposure to supply-chain compromise or incompatible versions and reduces the ability to reproduce and audit builds.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

yfinance>=0.2.36
pandas>=2.0.0
numpy>=1.24.0
matplotlib>=3.7.0
plotly>=5.18.0
scipy>=1.11.0
statsmodels>=0.14.0

• Confidence: 95% confidence
• Finding: matplotlib>=3.7.0 allows unbounded upgrades, which can pull in untested or compromised versions. This is a common dependency hygiene issue rather than evidence of malicious intent, but it still weakens software supply-chain security.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas>=2.0.0
numpy>=1.24.0
matplotlib>=3.7.0
plotly>=5.18.0
scipy>=1.11.0
statsmodels>=0.14.0
requests>=2.31.0

• Confidence: 95% confidence
• Finding: plotly>=5.18.0 permits any future version, creating non-deterministic builds and increasing supply-chain risk. Since this skill generates reports and likely renders rich output, dependency stability matters for both security and reliability.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy>=1.24.0
matplotlib>=3.7.0
plotly>=5.18.0
scipy>=1.11.0
statsmodels>=0.14.0
requests>=2.31.0
openpyxl>=3.1.0

• Confidence: 95% confidence
• Finding: scipy>=1.11.0 is an unpinned dependency, so later unreviewed versions may be installed automatically. This does not prove an active exploit path, but it does create avoidable supply-chain exposure and hampers reproducibility.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

matplotlib>=3.7.0
plotly>=5.18.0
scipy>=1.11.0
statsmodels>=0.14.0
requests>=2.31.0
openpyxl>=3.1.0
Jinja2>=3.1.0

• Confidence: 95% confidence
• Finding: statsmodels>=0.14.0 allows arbitrary future releases, which can introduce vulnerabilities or unexpected behavior. For an analysis skill relied on for financial outputs, deterministic builds are preferable.

Static analysis

No suspicious patterns detected.