InvAssistant

• Outcome: Pass
• Latest audit: Oct 19, 2026 · 11:37 AM UTC
• Version: 2.3.19

Overview

This is a disclosed investment decision-support skill with optional local reports, market-data fetching, and user-configured webhook notifications; it does not include broker access or autonomous trade execution.

Before installing, treat this as financial decision support only: review any suggested portfolio actions yourself, check webhook URLs before enabling pushes, keep notification secrets in environment variables or private config, and review local portfolio/config file edits before relying on future outputs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (21)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest text at L011 states the scripts "never place trades autonomously." However, the same file's operational documentation describes execution behavior such as "Execute immediately" and "Execute on trigger" for entry logic (L137-L139), which contradicts the claim that the skill is purely non-executing decision support. Even if these are framework rules rather than confirmed implemented code paths, the inline documentation presents conflicting intent about whether execution is in scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill guidance is written only in Chinese and does not offer any language or locale choice. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is documented and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document creates inconsistent write-safety rules: it says the first three local parameter files can be written directly, but also establishes a broader requirement that some state-changing updates must be shown to the user and explicitly confirmed before persistence. In an agent workflow, this ambiguity can be exploited or simply misapplied to justify unauthorized file writes, especially for portfolio configuration files that materially affect downstream behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill content is predominantly written in Chinese, including headings, rules, and operating instructions, with no indication that users may choose another language or that the skill is intended only for a Chinese-speaking or region-specific audience. This creates a natural-language locale constraint that could violate organizational language-choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all operational guidance only in Chinese and does not provide an opt-in, alternative language, or a documented region-specific justification for restricting the content to that language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

SQP-3 applies to all file types and includes language or locale policy violations. This file’s docstring and action descriptions are entirely Chinese-language with no indication that the skill is region-specific or that users may choose another language, which can conflict with organizational expectations for language choice or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module docstring presents the script name, description, and usage entirely in Chinese, and all user-facing output strings throughout the script are also Chinese-only. This creates a locale policy concern because the skill implicitly requires a specific language without offering user opt-in or stating that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The top-level documentation says mode selection uses 'VIX > 20' and 'VIX < 20' as the deciding boundary. However, check_market uses DEFAULT_MARKET_PARAMS['vix_threshold'] = 25, and determine_entry_mode also defines a configurable threshold variable defaulting to 25 even though the branch logic hardcodes 20, creating contradictory intent/documentation around the actual thresholding behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code performs an HTTP POST to a DingTalk webhook containing report data, which is a network transmission of potentially sensitive portfolio or system-derived information. Although the module docstring says it pushes check results, there is no in-code confirmation prompt or explicit user-facing warning at the point of transmission about sending data to an external service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The Feishu post payload is explicitly constructed only under the zh_cn locale key, and the surrounding CLI/help text and message content are also fixed in Chinese. This forces a specific language/locale behavior without offering the user a choice or documenting that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file includes a natural-language policy requiring 'Chinese comments for business logic, English for technical infrastructure.' This enforces a specific language choice rather than offering contributors a choice, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

L21 明确写明对 WorkBuddy 说「检查持仓」，整份文档也仅以中文描述交互方式，未见提供其他语言选项或说明语言限制的正当理由。根据规则，强制特定语言且无用户选择/opt-in 可能构成语言或 locale 政策违规。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file's natural-language instructions are entirely Chinese and do not indicate that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking or China-region audience. Under the policy rule for language or locale constraints, forcing a single language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

The requests dependency is only range-pinned at >=2.31,<3.0, and multiple known advisories exist within the 2.x line, including recent issues such as credential leakage and TLS verification problems in some usage patterns. Because the manifest allows installation of potentially affected releases and does not lock to a known-safe version, consumers may resolve to a vulnerable package version depending on install time and environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module title, description, and API documentation are written entirely in Chinese, which imposes a specific language/locale on users and maintainers without offering a language choice. The stated policy flags language or locale constraints when they are forced rather than opt-in or explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains natural-language strings in the module docstring that define usage and environment information only in Chinese. Under the language/locale policy rule, forcing a single language without user opt-in or justification is a policy concern, especially since command help and operational output are also presented to users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Throughout the script, warnings, errors, summaries, and argparse help text are emitted only in Chinese. This imposes a specific language on all users of the skill and does not provide an explicit locale choice or a documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file includes prominent natural-language instructions and descriptions entirely in Chinese, presenting the skill as Chinese-only behavior. Under the policy rule for language/locale constraints, this is a locale/language preference baked into the skill text without offering a user choice or documenting a justified region-specific restriction.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The docstring says mode B is chosen when the market is above MA50, implying a 50-day moving average check. But the function only requires len(qqq_df) >= 25 before computing a 50-day rolling mean, so latest_ma50 will often be NaN and the documented MA50 decision rule is not actually applied under those inputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains natural-language instructions, help text, and messages entirely in Chinese, and the CLI description and usage do not indicate that the skill is China-specific or offer a user language choice. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.