Security audit

TDX Formula Master

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Chinese-language helper for creating and checking TongDaXin stock formulas, with no evidence of hidden access, persistence, network use, or data exfiltration.

Install only if you want a Chinese-language TongDaXin formula reference and local validator/generator. Treat the stock formulas as educational templates, verify them in TongDaXin before use, and do not rely on the advertised backtesting or capital-flow wording as evidence of a full analysis engine.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 该代码的核心功能非常明确：1) validateFormula 对输入公式做函数名检查、未来函数检测、括号/分号/输出行校验，并给出 warnings；2) generateFormula 依据少量关键词从固定模板库返回预设公式；3) 通过 check/check-file/gen/list 提供命令行入口。虽然模板中涉及“金叉”“放量突破”“龙头”等若干选股主题，和描述有部分重合，但描述中强调的‘回测模板板块轮动主力资金分析’并未在代码中体现。代码没有回测引擎、历史数据处理、收益评估、板块轮动排序、资金流分析等能力，因此描述显著高于实际行为，属于目的与能力不匹配。

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill includes shell and Node.js execution instructions (`bash install.sh`, `node formula-validator.js ...`) without any trust boundary, integrity, or review warning. This can normalize direct execution of repository scripts from untrusted skill content, increasing the chance that users run malicious or modified local code without inspection.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: 该 markdown 文件给出的用户示例“帮我加个财务过滤”缺少明确的通达信/公式上下文，属于较通用的自然语言表达，容易与其他非本技能场景的普通请求重叠。文档也未提供负例或更严格的触发边界来限定何时应激活该技能。

Vague Triggers

Medium

Confidence: 83% confidence
Finding: “gen — 自然语言生成公式”描述了可由自然语言触发的能力，但没有说明需要哪些明确关键词、适用范围或不适用场景。对 markdown 技能说明而言，这种缺少边界的触发描述可能导致调用条件过宽。

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: This code embeds user-facing descriptions, help text, errors, and results entirely in Chinese, including the tool name/description and all CLI messages. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.

Natural-Language Policy Violations

Low

Confidence: 79% confidence
Finding: 文件标题与描述整体固定为中文定位，但未说明是否支持其他语言或允许用户选择输出语言。根据语言/地区策略，若技能默认强制单一语言而无用户选择，可能构成自然语言层面的策略问题。

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The script presents its user-facing messages and usage examples in Chinese, including the title and command examples, with no indication that this is a region-specific tool or that another language is available. This can violate language/locale policy when users are not given an opt-in or alternative locale.

Static analysis

No suspicious patterns detected.