国泰海通证券-灵犀市场热榜查询

• Outcome: Review
• Latest audit: May 28, 2026 · 5:45 AM UTC
• Version: 1.0.1

Overview

This skill appears purpose-built for market-ranklist queries, but it handles brokerage API credentials in broad local files and makes an unsupported official-publisher claim that users should review before installing.

Install only if you trust the publisher and have verified the claimed Guotai Haitong affiliation through an official channel. Use a limited, revocable API key if possible, expect the key to be saved locally in plaintext, and remove or rotate it when done. Also review the QR authorization flow, localhost proxy behavior, and cross-skill fallback before using it in a shared workspace.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to save user-supplied API keys to disk and elsewhere in shared workspace paths, which expands the skill from data retrieval into credential management. Persisting secrets in loosely defined relative paths increases the risk of accidental exposure, reuse by other skills/processes, or unauthorized deletion/modification.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The skill directs the agent to discover and invoke `gtht-financialsearch-skill` when requests exceed ranklist scope, effectively broadening execution beyond the declared single-skill purpose. Cross-skill delegation can bypass user expectations and security review boundaries, especially if the secondary skill has different permissions, data access, or output guarantees.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements a much broader capability set than the stated market-ranklist skill: QR-based auth generation, local HTTP proxying, polling remote auth services, API-key persistence, and JWT handling. This materially expands the attack surface and grants the skill credential-handling powers unrelated to simple ranklist retrieval, increasing the risk of credential abuse, unauthorized persistence, and hidden side effects.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code enumerates network interfaces to obtain a MAC address and derives device identifiers for the QR/auth flow, which is not necessary for a market leaderboard query skill. Collecting stable device identifiers increases privacy risk and can enable cross-session tracking or device fingerprinting if leaked or reused by backend services.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger keywords include broad terms like `热榜`, `排行榜`, and related generic ranking phrases, which can cause the skill to activate in unintended contexts. In this skill, accidental triggering is more dangerous because activation can lead into authorization prompts, credential handling, and external network operations rather than a harmless local transformation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document tells the agent to accept a user-provided API key and write it to a local JSON file, but it does not provide clear warnings about secret handling, local persistence, reuse risk, or who can access that file. This is dangerous because users may paste high-value credentials into a conversational flow without understanding they will be stored on disk in a shared workspace location.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs deletion of local authorization files as part of error recovery, but does not require clear user notification or confirmation before removing credential state. Silent or poorly disclosed deletion can disrupt other sessions, erase valid credentials unexpectedly, or be abused by prompt injection to induce destructive local state changes.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill writes API keys to disk in multiple possible filesystem locations without enforcing secure permissions, encryption, or a user-facing consent boundary at the write site. Persisted credentials on disk can be recovered by other local processes, included in backups, or accidentally exposed if the shared config path is readable by unintended components.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: skill-entry.js:1