Security audit

gh-stock-deep-analysis

Security checks for vulnerabilities and agentic risk

Overview

This stock-analysis skill includes automatic report saving, Feishu/Wiki publishing, and fixed chat-group notifications that are not clearly user-controlled.

Install only if you expect each stock analysis to create local records, publish a Feishu/Wiki document, and notify the named chat group. Prefer a version that requires explicit confirmation before saving, publishing, or messaging, and that narrows triggers to clear stock-analysis requests.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill is presented as a stock-analysis framework, but it also instructs the agent to save reports locally, update a history index, publish content to Feishu Wiki, and notify a chat group. These side effects are unrelated to the core analytical function and create unauthorized data exfiltration and action-taking risk, especially because users are not clearly informed that invoking analysis can trigger external publication and messaging.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Using lark-cli to create and move Feishu documents gives the skill an external write/publish capability that is not justified by merely analyzing a stock. This can cause sensitive prompts, generated content, or internal workspace data to be pushed into third-party systems without clear authorization, turning a read/analysis workflow into an outbound action workflow.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The requirement to send a message to a fixed chat ID introduces unsolicited external communication unrelated to the stated stock-analysis purpose. If triggered unintentionally, the skill could spam channels, leak analysis results, or disclose user activity and stock interests to a group the user did not intend to contact.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill is designed to trigger on a bare stock name or code, which can activate analysis when a user merely mentions a ticker in passing rather than explicitly requesting financial analysis. This can cause unintended tool use, confusing behavior, and unsolicited investment-style outputs, especially in general conversations where stock symbols are ambiguous.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger phrases are broad enough to activate on ordinary conversational input, especially generic terms like analysis-related words paired with stock-like text. Because this skill also performs side effects such as file writes and external publication steps, over-triggering materially increases the chance of unintended execution and downstream data disclosure.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: Allowing a bare stock name or code to auto-trigger the skill is ambiguous and can cause execution without a clear user request for analysis. In this context, accidental invocation is more dangerous because the skill is not purely informational; it includes saving, publishing, and notification behaviors that could occur without informed user intent.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill description does not clearly warn users that running the skill will write local files, modify history records, create Feishu documents, and send chat notifications. This lack of disclosure defeats informed consent and makes the external side effects substantially more dangerous, since users may believe they are requesting only a local analysis response.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger list includes very broad patterns such as "股票名称", "股票代码", "深度分析.*", and generic numeric/market-code regexes, which can cause the skill to activate on incidental mentions rather than clear user intent. In a finance context, unintended activation is risky because it may produce authoritative-seeming investment analysis when the user did not explicitly request this skill, increasing the chance of misleading or context-inappropriate financial guidance.

Natural-Language Policy Violations

Medium

Confidence: 80% confidence
Finding: Forcing "zh-CN" output without user choice reduces usability and can cause misunderstanding if the user expects another language, especially for nuanced financial risk disclosures. While not a direct security exploit, it can degrade informed consent and clarity, which matters more in an investment-analysis skill where precise comprehension is important.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 90% confidence
Finding: The single-word trigger '分析' is so broad that it can match many unrelated requests. In isolation this might be low risk, but in this skill it becomes more dangerous because accidental activation can cascade into local writes, external document creation, and outbound group notifications.

Static analysis

No suspicious patterns detected.