Security audit

Factorlab

Security checks for vulnerabilities and agentic risk

Overview

FactorLab is a disclosed A-share factor-analysis tool, but its buy labels and live market-data access require cautious use.

Install only if you want a research-oriented A-share scoring helper. Check whether each result uses live or simulated data, avoid treating its buy labels as personalized financial advice, and be aware that live mode may contact external TDX market-data servers with the stock codes you ask about.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill documentation directs the agent to read local files such as `references/factor_theory.md` and execute a local script, but the manifest shown does not declare corresponding permissions. This creates a capability/permission mismatch that can lead to undeclared file access and reduces the platform's ability to constrain or audit what the skill can read.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The top-level description says the skill should trigger for generic requests like whether a stock is worth buying, factor analysis, scoring, or quantitative analysis. Those phrases are common in ordinary financial conversations, so the trigger scope is too broad and may cause the skill to activate when the user did not intend to invoke this particular tool.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation scenarios enumerate broad intents such as asking whether a stock is worth buying or requesting stock screening, without clear boundaries or confirmation steps. In practice this can cause unintended invocation and over-application of an automated stock-picking workflow to routine discussion, increasing the risk of inappropriate or low-context outputs.

Natural-Language Policy Violations

High

Confidence: 96% confidence
Finding: The skill description explicitly promises clear buy recommendations such as 'strongly recommend buy' and 'recommend buy' while also positioning itself as an analysis tool. That is a direct policy and safety inconsistency: the system is not merely explaining factors but steering purchase decisions, which can mislead users into treating the output as personalized investment advice.

Natural-Language Policy Violations

High

Confidence: 97% confidence
Finding: The workflow instructs the agent to read the report and then give users purchase recommendations in natural language, despite a later disclaimer stating the system is not investment advice. This inconsistency is dangerous because it operationalizes actionable financial guidance while relying on a disclaimer that does not meaningfully reduce user reliance or harm.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: The skill makes outbound network connections to hard-coded market data servers without any explicit user-facing disclosure or consent path. In an agent environment, silent external requests can leak usage patterns, queried stock interests, IP metadata, and operational context to third parties, which is a privacy and supply-chain trust concern.

Static analysis

No suspicious patterns detected.