Taiwan Stock Info

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:35 AM UTC
• Version: 1.0.0

Overview

This is a documentation-only skill for querying Taiwan stock data APIs, with no hidden execution, persistence, or unrelated data access found.

Install only if you intend to use Fugle or FinMind for stock data. Treat any Fugle API key or FinMind token as sensitive, prefer environment variables or a secret store for real credentials, and review the providers' terms and rate limits before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (22)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

Base URL

text

https://api.finmindtrade.com/api/v4/data

Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api/finmind.md (reported line 5)May include surrounding context.

Base URL

text

https://api.finmindtrade.com/api/v4/data

Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api/finmind.md (reported line 77)May include surrounding context.

Base URL

text

https://api.finmindtrade.com/api/v4/data

Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api/finmind.md (reported line 85)May include surrounding context.

Base URL

text

https://api.finmindtrade.com/api/v4/data

Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api/finmind.md (reported line 93)May include surrounding context.

Base URL

text

https://api.finmindtrade.com/api/v4/data

Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · example.md (reported line 71)May include surrounding context.

Base URL

text

https://api.finmindtrade.com/api/v4/data

Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · example.md (reported line 105)May include surrounding context.

Base URL

text

https://api.finmindtrade.com/api/v4/data

Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · example.md (reported line 114)May include surrounding context.

Base URL

text

https://api.finmindtrade.com/api/v4/data

Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · example.md (reported line 123)May include surrounding context.

Base URL

text

https://api.finmindtrade.com/api/v4/data

Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · example.md (reported line 132)May include surrounding context.

Base URL

text

https://api.finmindtrade.com/api/v4/data

Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · example.md (reported line 141)May include surrounding context.

Base URL

text

https://api.finmindtrade.com/api/v4/data

Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · example.md (reported line 159)May include surrounding context.

Base URL

text

https://api.finmindtrade.com/api/v4/data

Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · example.md (reported line 171)May include surrounding context.

Base URL

text

https://api.finmindtrade.com/api/v4/data

Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api/fugle.md (reported line 30)May include surrounding context.

1. Get Real-time Quote (即時報價)

bash

curl -X GET "https://api.fugle.tw/intraday/quote/2382" \
  -H "X-API-Key: {your_fugle_api_key}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · example.md (reported line 12)May include surrounding context.

1. Get Real-time Quote (即時報價)

bash

curl -X GET "https://api.fugle.tw/intraday/quote/2382" \
  -H "X-API-Key: {your_fugle_api_key}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · example.md (reported line 38)May include surrounding context.

1. Get Real-time Quote (即時報價)

bash

curl -X GET "https://api.fugle.tw/intraday/quote/2382" \
  -H "X-API-Key: {your_fugle_api_key}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · example.md (reported line 48)May include surrounding context.

1. Get Real-time Quote (即時報價)

bash

curl -X GET "https://api.fugle.tw/intraday/quote/2382" \
  -H "X-API-Key: {your_fugle_api_key}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · example.md (reported line 54)May include surrounding context.

1. Get Real-time Quote (即時報價)

bash

curl -X GET "https://api.fugle.tw/intraday/quote/2382" \
  -H "X-API-Key: {your_fugle_api_key}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · example.md (reported line 60)May include surrounding context.

1. Get Real-time Quote (即時報價)

bash

curl -X GET "https://api.fugle.tw/intraday/quote/2382" \
  -H "X-API-Key: {your_fugle_api_key}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · example.md (reported line 153)May include surrounding context.

1. Get Real-time Quote (即時報價)

bash

curl -X GET "https://api.fugle.tw/intraday/quote/2382" \
  -H "X-API-Key: {your_fugle_api_key}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · example.md (reported line 165)May include surrounding context.

1. Get Real-time Quote (即時報價)

bash

curl -X GET "https://api.fugle.tw/intraday/quote/2382" \
  -H "X-API-Key: {your_fugle_api_key}"

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The examples instruct users to place live API credentials directly on the curl command line in an Authorization or X-API-Key header. While this is common documentation practice, command-line secrets can be exposed through shell history, process listings, terminal logging, or copied transcripts, creating an avoidable credential-handling weakness.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.