uwillberich

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:24 PM UTC
• Version: 0.1.12

Overview

This finance-planning skill uses credentials, network data, local files, and optional background polling in ways that are disclosed and aligned with its market-analysis purpose.

Install only if you are comfortable providing an Eastmoney API key, making live finance-data requests, and storing reports under your home directory. Enable the launchd/background news iterator only if you want ongoing polling, and remove it with the provided uninstall command when you no longer need it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises executable capabilities including environment access, file read/write, network access, and shell use, but does not declare permissions or constrain those operations. This creates a trust and review gap: users may invoke a market-analysis skill without realizing it can access local files, credentials, or perform networked/background actions beyond simple analysis.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is narrow financial planning, but the skill also describes persistent polling, local storage, credential management, broad API querying, report generation, and installation of a macOS launchd agent. That mismatch is dangerous because users may consent to a benign-seeming analysis workflow while the skill performs broader automation and persistence on the host.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file describes a persistent RSS ingestion, scoring, storage, and automatic stock-pool generation subsystem, which materially expands the skill beyond a simple next-session planning aid. This hidden capability increases attack surface through continuous network access, local persistence, and autonomous data processing that a user may not reasonably expect from the skill metadata.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The long-running deployment instructions using nohup and launchd enable the skill to operate autonomously outside normal user interaction, continuously polling feeds and updating local artifacts. For a skill presented as a discretionary pre-open workflow tool, this is dangerous because it normalizes unattended execution and persistent background behavior without clear necessity or consent boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The script installs and starts a persistent macOS LaunchAgent, which materially expands the skill's capabilities beyond a market-analysis workflow. Persistence mechanisms are security-sensitive because they enable repeated background execution and can be repurposed for stealthy data collection, command execution, or long-lived abuse if the skill or its dependencies are compromised.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: This code manages OS-level persistence via launchctl bootout/bootstrap/kickstart, creating an automatically recurring background task. In the context of a stock-planning assistant, that capability is not clearly justified and increases risk because it lets the skill maintain execution outside the user's immediate awareness.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This code provides a CLI to set, unset, and persist an Eastmoney API key in a local env file, which is functionality beyond the skill's stated market-planning purpose. While local credential management is not inherently malicious, bundling secret persistence and capability-gating into a market-analysis skill increases attack surface and can normalize unnecessary credential collection.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The file gates functionality on the presence of EM_API_KEY/MX_APIKEY and instructs users to obtain and store a third-party API credential, which does not align cleanly with the described discretionary market-planning workflow. This mismatch is risky because users may grant secrets to a skill whose declared purpose did not make credential handling explicit.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The README explicitly promises a workflow that can 'save all artifacts' but does not clearly warn users that outputs will be written to local storage. In a trading/news-monitoring skill, silent persistence can expose watchlists, queries, and generated reports to other local users or leave residual sensitive data behind unexpectedly.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README describes continuous news watching plus persistent SQLite, markdown, and JSONL outputs without a clear privacy/storage disclosure. Continuous polling combined with retained local state increases the chance of unintended long-term collection of queries, event classifications, and market-research artifacts, especially on shared machines.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README includes a command to install a launchd job for scheduled polling but does not prominently state that this creates a recurring background task. Background persistence changes the host's behavior beyond a one-shot script run and may surprise users, consume resources, or continue collecting and writing data after the initial session ends.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill requires an API key stored in a local runtime file but provides no security guidance about file permissions, secret rotation, redaction, or avoiding accidental disclosure in logs and outputs. Because the skill also uses file, env, network, and shell capabilities, mishandled credentials could be exposed or reused by other local processes or unintended workflow steps.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill enables implicit invocation but does not define narrow trigger constraints, which can cause the agent to auto-select this skill in situations broader than intended. Because the skill produces discretionary market guidance, unintended invocation could lead to irrelevant or overconfident financial recommendations being surfaced without clear user intent.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger list includes generic terms such as "power", "electricity", "energy", "gas", and "shipping" that can match many ordinary market or macro queries unrelated to the intended industry-chain theme. In this skill, broad matching can misroute user intent, causing the agent to activate the wrong market framework and produce misleading trading analysis, which is a meaningful integrity risk even if it is not a code-execution issue.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation states that the module continuously polls public RSS feeds and stores alerts in a local SQLite database, but the skill description does not warn users about ongoing network activity and persistent local data storage. This omission undermines informed consent and can lead users to install or run a component with materially different privacy and operational characteristics than expected.

Credential Access

High

• Category: Privilege Escalation

Content

custom = os.environ.get(env_var)
        if custom:
            paths.append(Path(custom).expanduser())
    paths.extend([DEFAULT_ENV_PATH, LEGACY_ENV_PATH, ROOT / ".env.local", ROOT / ".env"])

    deduped: list[Path] = []
    seen: set[str] = set()

• Confidence: 86% confidence
• Finding: .env.local"

Credential Access

High

• Category: Privilege Escalation

Content

custom = os.environ.get(env_var)
        if custom:
            paths.append(Path(custom).expanduser())
    paths.extend([DEFAULT_ENV_PATH, LEGACY_ENV_PATH, ROOT / ".env.local", ROOT / ".env"])

    deduped: list[Path] = []
    seen: set[str] = set()

• Confidence: 86% confidence
• Finding: .env"

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.