港股美股分析

• Outcome: Review
• Latest audit: May 29, 2026 · 9:26 PM UTC
• Version: 2.1.0

Overview

This stock-analysis skill is mostly purpose-aligned, but it includes under-disclosed third-party calls, exposed API tokens, and financial indicators that can be generated from simulated data while presented as actionable analysis.

Install only if you are comfortable with stock symbols being sent to third-party market/news APIs and with reviewing outputs critically. Do not treat the generated technical indicators or buy/hold/sell suggestions as reliable financial advice unless the publisher replaces simulated data with real historical market data, removes/rotates exposed API keys, and documents all external services used.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tainted flow: 'url' from os.environ.get (line 109, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

try:
        url = f'https://finnhub.io/api/v1/quote?symbol={code}&token={FINNHUB_KEY}'
        r = requests.get(url, timeout=10).json()
        
        if r.get('c'):  # current price
            return {

• Confidence: 92% confidence
• Finding: r = requests.get(url, timeout=10).json()

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The report presents technical indicators as if they were derived from market history, but it actually generates random mock prices around the current price. In a stock-analysis skill, this is dangerous because it can mislead users into making financial decisions based on fabricated analytics while appearing authoritative.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The function documentation claims historical prices are obtained for indicator calculation, but the implementation returns no data and the report later substitutes random values. This discrepancy is security-relevant in context because it conceals unreliable analysis behind misleading documentation, reducing the chance that users or reviewers will detect fabricated outputs.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The code fetches market data for the US ticker 'JD' but presents it as analysis for '京东快递 (9628.HK)', creating a materially misleading financial output. In a stock-analysis skill, symbol/output mismatch is dangerous because users may act on incorrect market data, leading to bad trading decisions or financial loss.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger set contains generic finance terms that can match normal conversation, causing the skill to activate unexpectedly. In a skill that performs external requests, unintended invocation can lead to surprise network access, unnecessary data disclosure, or confusing responses in unrelated chats.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The description presents data sources but does not warn users that invoking the skill will send requests to external third-party providers. This is a privacy and transparency issue because user queries, stock interests, and possibly session metadata may be transmitted off-platform without informed consent.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: A hardcoded Finnhub API token is embedded directly in source and used in outbound requests. Secrets in code are easily leaked through repositories, logs, packaging, or downstream redistribution, enabling unauthorized API use, quota exhaustion, billing abuse, and possible service disruption for the skill.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code embeds a live API token directly in source and transmits it to a third-party service on every request. This is dangerous because the credential can be extracted from the skill code, reused by unauthorized parties, and the outbound transfer happens without any disclosure to users that external services are being contacted.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script makes additional outbound requests to Finnhub for candle and recommendation data without informing the user that data is being sent to a third-party API. In an agent skill context, undisclosed network access increases privacy and trust risks because user-triggered actions may silently cause external data sharing and dependency on remote services.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: A live API token is hardcoded directly in the source and sent in outbound requests, which exposes a credential to anyone who can view the code, logs, or packaged skill contents. In a skill context, this is more dangerous because skills are often distributed, inspected, or reused by others, enabling unauthorized API use, quota exhaustion, billing abuse, or token revocation that breaks the service.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code embeds a hard-coded Finnhub API token and sends user-supplied stock symbols to an external service without disclosure. Hard-coded secrets are recoverable from source and can be abused, and undisclosed outbound requests create privacy, compliance, and supply-chain risks for users of the skill.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The news-analysis step sends the requested symbol to external APIs without clearly informing the user. While the symbol alone is usually low sensitivity, the skill context still makes this relevant because user interests, watchlists, or holdings can be inferred from requests to third-party providers.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill sends user-provided stock symbols to third-party quote/news services without any user-facing notice or consent. While the transmitted data is limited, undisclosed external transmission can create privacy and compliance issues, especially in agent environments where users may assume local-only processing.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The skill accesses an API credential and uses it for external requests without disclosing this behavior to the user. In agent or hosted environments, hidden credential use reduces transparency and can surprise operators about third-party dependencies and data-sharing behavior.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: A hardcoded API token embedded in code is a real secret-handling issue because anyone with access to the file can extract and reuse it for unauthorized API calls. In an agent skill that performs outbound requests, this increases the risk of credential leakage, quota exhaustion, account abuse, and unintended third-party data access.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.