股票投资智投顾问

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:35 PM UTC
• Version:
  1.0.0

Overview

This stock-analysis skill is coherent and purpose-aligned, but users should understand it may search the web, use financial-data APIs, and create Feishu cloud reports containing their stock-analysis context.

Install this only if you want a stock-advisor skill that can perform web searches, use financial-data services, process chart screenshots, and generate Feishu cloud documents. Keep API tokens out of shared files and logs, review any optional helper scripts before adding them, and avoid submitting private portfolio details or sensitive screenshots unless external cloud reporting is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrases include very broad, natural-language expressions such as asking whether a stock is good or whether it can be bought. In an agent platform, overly generic triggers can cause unintended activation during normal conversation, leading the skill to fetch external data or generate reports without sufficiently explicit user intent.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README states that the skill will access multiple external market/news sources and output professional reports to Feishu cloud documents, but it does not clearly disclose what user-provided content, prompts, screenshots, or analysis results may be transmitted to third parties. This creates a privacy and data-governance risk because sensitive investment interests or uploaded images could be sent off-platform without informed user awareness.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The documentation instructs users to export a Tushare token but provides no guidance on secure storage, scope limitation, rotation, or avoiding accidental disclosure in logs and shared environments. While this is not an exploit by itself, weak credential-handling guidance increases the chance of token leakage and unauthorized API use.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to create a Feishu cloud document containing the generated investment analysis, but it does not require obtaining explicit user consent or warning that potentially sensitive inputs, portfolio details, screenshots, and analysis outputs will be sent to an external third-party service. In this context, users may share financial positions and proprietary research, so silent exfiltration to Feishu creates a real privacy and data-handling risk.

VirusTotal

67/67 vendors flagged this skill as clean.