华尔街股票分析系统

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:33 PM UTC
• Version:
  1.0.0

Overview

This is a disclosed stock-analysis instruction skill that fetches public market data and does not request credentials, local files, persistence, or trading authority.

Before installing, be comfortable with the agent making live requests to third-party finance data providers when you ask for stock analysis. Verify investment conclusions independently; the skill does not trade, access accounts, or handle credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger condition uses the catch-all phrase “或类似指令” (“or similar instructions”), which makes skill activation boundaries ambiguous. In an agent environment, vague activation can cause unintended invocation on loosely related user input, increasing the chance of accidental tool use, confused routing, or prompt collisions with other skills.

VirusTotal

64/64 vendors flagged this skill as clean.