Security audit

A股消息面分级解读

Security checks for vulnerabilities and agentic risk

Overview

The skill only provides Chinese A-share stock-news interpretation guidance and does not install code or access data, though its trading suggestions should be treated cautiously.

Before installing, understand that this skill may answer stock-news questions with direct trading-style suggestions. Use it as an interpretation aid, not as financial advice, and consider narrowing triggers if you do not want it to activate for short generic trading prompts.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrases are very broad generic finance questions such as '这个利好是真的吗' and '能追吗', which are likely to overlap with ordinary user requests outside the intended skill-routing boundary. This can cause the skill to activate too often and steer users into prescriptive trading-oriented advice, increasing the risk of inappropriate financial guidance and misrouting.

Natural-Language Policy Violations

Low

Confidence: 91% confidence
Finding: All user-facing descriptive content and trigger phrases are exclusively in Chinese, and the file does not indicate that the skill supports language selection or that Chinese-only operation is an explicit opt-in requirement. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless the locale restriction is clearly documented and justified.

Static analysis

No suspicious patterns detected.