Security audit

Break Watch

Security checks for vulnerabilities and agentic risk

Overview

Break Watch is a disclosed stock-scanning skill that fetches market data and can write local scan outputs, with dependency hygiene issues but no evidence of deception, credential access, exfiltration, or destructive behavior.

Install only if you are comfortable letting the skill contact Tongdaxin market-data servers and write scan results under its configured output directories. Prefer pinning dependencies first, and avoid installing pyinstaller unless you specifically need to package the tool.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs the agent to create a Python virtual environment, install a package, run a local script, and optionally write output files, but it does not declare any permissions for file read/write behavior. This creates a capability/permission mismatch that can lead to unreviewed filesystem access and package installation side effects, which is risky even though the stated purpose is legitimate market scanning.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The activation boundary is underspecified because the skill describes many positive trigger terms but does not define clear exclusions, confirmation requirements, or when not to run. In context, this matters because the skill is not purely informational: it can initiate environment setup, execute Python, contact external market servers via pytdx, and generate files.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The activation boundary is underspecified because the skill describes many positive trigger terms but does not define clear exclusions, confirmation requirements, or when not to run. In context, this matters because the skill is not purely informational: it can initiate environment setup, execute Python, contact external market servers via pytdx, and generate files.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pytdx pyinstaller
Confidence: 93% confidence
Finding: The dependency `pytdx` is unpinned, so installs may resolve to different versions over time, including versions with breaking changes or newly introduced vulnerabilities. This weakens supply-chain integrity and makes builds non-reproducible, though by itself it does not indicate active exploitation.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pytdx pyinstaller
Confidence: 98% confidence
Finding: `pyinstaller` is unpinned, which creates a supply-chain risk because future installs may pull in unexpected or vulnerable releases. In this case the risk is elevated because the package also has known security advisories, so leaving it unpinned increases the chance of resolving to an unsafe version.

Known Vulnerable Dependency: pyinstaller — 6 advisory(ies): CVE-2019-16784 (Local Privilege Escalation in PyInstaller); CVE-2023-49797 (Local Privilege Escalation in Windows); CVE-2025-59042 (PyInstaller has local privilege escalation vulnerability) +3 more

High

Category: Supply Chain
Confidence: 96% confidence
Finding: The project depends on `pyinstaller`, which has multiple published security advisories including local privilege escalation issues. If this package is used in developer, build, or packaging environments, a vulnerable version could be abused to compromise the local system or the software build pipeline.

Static analysis

No suspicious patterns detected.