Security audit

hekouwang-stock-data-reader-skill

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed stock-data reporting pipeline; users should expect third-party market-data lookups and local report files, including cleanup of generated HTML after screenshots.

Install only if you are comfortable with a finance-reporting skill that runs local scripts, installs Python dependencies, queries third-party public market-data services for the stock codes you request, and removes generated HTML after screenshots. Keep copies of intermediate HTML if you need auditability, and review generated financial text before publishing.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Context-Inappropriate Capability

Low

Confidence: 87% confidence
Finding: The script resolves a font directory from either an environment variable or a sibling skill path under the shared skills tree. That creates unnecessary cross-skill local file access and trust coupling: a different local skill or a manipulated environment can influence what assets this script loads, which is unrelated to core report generation. In a shared local agent environment, this weakens isolation and can leak filesystem structure or consume attacker-controlled local files.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The script unconditionally deletes each source HTML file immediately after a successful screenshot. This creates a destructive side effect not apparent from the skill's read/report-oriented description, and can cause data loss or hinder auditability and troubleshooting if users do not realize their generated source artifacts will be removed.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The README advertises very broad natural-language triggers such as '给我一只股的数据体检' and '对 Claude 说人话即可', which can cause the agent to invoke this skill in loosely related conversations. Because the skill performs a multi-step pipeline including external data fetching and report generation, overbroad invocation increases the chance of unintended execution, unnecessary network access, and user confusion about when the skill is acting.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The README prominently describes fetching stock data from external sources with akshare but does not clearly foreground that using the skill causes outbound network requests to third-party data providers. In an agent setting, this can surprise users, leak query intent or stock interests to external services, and trigger connectivity or policy issues in restricted environments.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger phrases are broad enough to match common user requests about stocks, fund flow, or company reports, which can cause the skill to activate in situations where the user did not explicitly intend this specific workflow. In a financial-analysis context, over-triggering is risky because it may steer conversations into regulated or sensitive content generation without clear user intent or consent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Automatic deletion without an explicit user-facing warning or confirmation is unsafe because users may lose intermediate artifacts needed for verification, debugging, or compliance review. In a content-generation workflow, removing source HTML also reduces transparency into what was rendered and makes it harder to detect tampering or reproduce outputs.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: templates/screenshot.js:17