Taiwan Stock Info

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:35 AM UTC
• Version: 1.0.0

Overview

This is a documentation-only skill for querying Taiwan stock data APIs, with no hidden execution, persistence, or unrelated data access found.

Install only if you intend to use Fugle or FinMind for stock data. Treat any Fugle API key or FinMind token as sensitive, prefer environment variables or a secret store for real credentials, and review the providers' terms and rate limits before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (22)

External Transmission

Medium

• Category: Data Exfiltration

Content

## Base URL
```
https://api.finmindtrade.com/api/v4/data
```

## Authentication

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Base URL
```
https://api.finmindtrade.com/api/v4/data
```

## Authentication

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Base URL
```
https://api.finmindtrade.com/api/v4/data
```

## Authentication

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Base URL
```
https://api.finmindtrade.com/api/v4/data
```

## Authentication

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Base URL
```
https://api.finmindtrade.com/api/v4/data
```

## Authentication

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Base URL
```
https://api.finmindtrade.com/api/v4/data
```

## Authentication

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Base URL
```
https://api.finmindtrade.com/api/v4/data
```

## Authentication

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Base URL
```
https://api.finmindtrade.com/api/v4/data
```

## Authentication

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Base URL
```
https://api.finmindtrade.com/api/v4/data
```

## Authentication

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Base URL
```
https://api.finmindtrade.com/api/v4/data
```

## Authentication

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Base URL
```
https://api.finmindtrade.com/api/v4/data
```

## Authentication

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Base URL
```
https://api.finmindtrade.com/api/v4/data
```

## Authentication

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Base URL
```
https://api.finmindtrade.com/api/v4/data
```

## Authentication

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1. Get Real-time Quote (即時報價)

```bash
curl -X GET "https://api.fugle.tw/intraday/quote/2382" \
  -H "X-API-Key: {your_fugle_api_key}"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1. Get Real-time Quote (即時報價)

```bash
curl -X GET "https://api.fugle.tw/intraday/quote/2382" \
  -H "X-API-Key: {your_fugle_api_key}"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1. Get Real-time Quote (即時報價)

```bash
curl -X GET "https://api.fugle.tw/intraday/quote/2382" \
  -H "X-API-Key: {your_fugle_api_key}"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1. Get Real-time Quote (即時報價)

```bash
curl -X GET "https://api.fugle.tw/intraday/quote/2382" \
  -H "X-API-Key: {your_fugle_api_key}"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1. Get Real-time Quote (即時報價)

```bash
curl -X GET "https://api.fugle.tw/intraday/quote/2382" \
  -H "X-API-Key: {your_fugle_api_key}"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1. Get Real-time Quote (即時報價)

```bash
curl -X GET "https://api.fugle.tw/intraday/quote/2382" \
  -H "X-API-Key: {your_fugle_api_key}"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1. Get Real-time Quote (即時報價)

```bash
curl -X GET "https://api.fugle.tw/intraday/quote/2382" \
  -H "X-API-Key: {your_fugle_api_key}"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1. Get Real-time Quote (即時報價)

```bash
curl -X GET "https://api.fugle.tw/intraday/quote/2382" \
  -H "X-API-Key: {your_fugle_api_key}"
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The examples instruct users to place live API credentials directly on the curl command line in an Authorization or X-API-Key header. While this is common documentation practice, command-line secrets can be exposed through shell history, process listings, terminal logging, or copied transcripts, creating an avoidable credential-handling weakness.

Static analysis

No suspicious patterns detected.