select-super-stock

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:53 AM UTC
• Version: 1.4.0

Overview

This skill is a narrowly scoped A-share stock data helper that fetches public market data and does not show hidden, persistent, credential, or account-changing behavior.

Before installing, understand that this is a Chinese-language informational tool for public A-share daily data. It requires running a local Python script and network collection through AKShare, but it does not place trades, manage accounts, install dependencies, read credentials, or provide investment advice.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill invokes a local shell command (python3 scripts/stock_analyzer.py --symbol 600938) but does not declare any explicit tool scope such as permissions or allowed-tools. This creates an execution-surface ambiguity: a host agent may permit broader shell access than the skill actually needs, increasing the risk of unintended command execution or misuse if the skill is modified or interpreted loosely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The entire policy document is written as mandatory Chinese-language guidance and does not offer any language or locale choice. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code presents user-facing validation text only in Chinese (for example, the symbol error message) and the rest of the CLI output is likewise hard-coded in Chinese. For a general-purpose skill, this effectively enforces a specific language/locale without user opt-in or an alternative language path.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/stock_analyzer.py (reported line 192)May include surrounding context.

python

command = [sys.executable, str(Path(__file__).resolve()), "--worker", "--symbol", args.symbol]
    if args.date: command += ["--date", args.date]
    try:
        child = subprocess.run(command, capture_output=True, text=True, timeout=args.timeout)
        result = json.loads(child.stdout) if child.returncode == 0 else failure(args.symbol, datetime.now(TZ), "采集进程失败")
    except subprocess.TimeoutExpired:
        result = failure(args.symbol, datetime.now(TZ), "真实数据采集超时；未使用默认值或缓存")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire skill file is written in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_analyzer.py:9