ARTi 机会雷达

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:47 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed finance-news workflow, but its README recommends an unpinned global install/update command and the runtime strongly steers reports toward tracked third-party ARTi links.

Review the installer before using it: prefer a pinned package and immutable skill revision instead of the README's global unpinned `npx -y` command. Also be aware that generated ARTi links encode the stock, company label, news title, source URL, and prompt into a third-party URL if clicked; avoid clicking them for sensitive research context unless that is acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:103

Finding

Mandatory Branded Traffic Diversion in Generated Reports

Content

View full analysis

str: prompt = ( f"请分析新闻《{title}》对 {label}（{symbol}）的潜在影响。" f"原文：{source_url}。" "请先核验事实，再分析业务暴露度、因果链、反方证据、关键风险和仍缺失的信息；" "不要给出买卖建议或确定性涨跌结论。" ) query = urlencode( { "q": prompt, "agent": "news-analyst", "utm_source": "arti-opportunity-radar", "utm_medium": "agent-skill", } ) return f"[用 ARTi 分析 {label}]({base_url}?{query})" ``` ### Technical Analysis The Skill requires the agent to generate a link to the fixed third-party domain `artifin.ai` for every stock considered worthy of additional research. The requirement is repeated in the output contract, making the promotional link a persistent part of ordinary report output rather than an optional feature selected by the user. The generated URL contains: - The stock symbol - The company label - The news headline - The original source URL - A generated research prompt - A fixed external agent identifier - UTM campaign-tracking parameters Generating a complete stock-news briefing does not ...[truncated 1805 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:5

Finding

Unpinned Package Execution and Global Skill Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code’s functionality is much narrower than the declared description. It does support one declared use case: opening a verified news event in ARTi for deeper stock analysis, and partially aligns with explaining how an event may affect a listed company by constructing an analysis prompt. However, it does not implement the broader advertised capabilities around personalization, watchlist import, source management, briefing generation, or news scanning. The primary behavior is a simple link builder for one article/company pair, so the description materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to run npx -y skills add illli/ChanceRadar -g --all without pinning a specific package/version for the skills tool. This allows whatever version is current in the registry at execution time to be fetched and run, creating a supply-chain risk if the package is updated maliciously, compromised, or changed incompatibly. Because this is an installation command presented for direct copy/paste, the context makes the risk more credible rather than theoretical.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The update instructions repeat the same unpinned npx -y skills add ... pattern, again causing users to execute the latest resolved package version at runtime. This exposes users to supply-chain compromise during updates, and update flows can be especially risky because users may run them repeatedly with less scrutiny. The skill’s finance-related purpose does not reduce the issue; if anything, tooling around market workflows can be attractive for targeted tampering.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file presents the skill name, operating instructions, and user-facing behaviors exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which it is not here.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Several triggers such as "早报", "晚报", "今日新闻", and "找机会" are generic phrases that can easily match ordinary user requests unrelated to this specific finance skill. In a finance context, unintended activation can cause the assistant to route users into investment-oriented workflows, expose portfolio/watchlist context, or generate market guidance when the user did not explicitly request this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The schema pre-populates locale as zh-CN and timezone as Asia/Shanghai without indicating these values are examples or requiring explicit user selection. In a skill that stores persistent user profile data, this can silently mis-profile users, cause time-sensitive reports to run at incorrect times, and create unnecessary collection of inferred regional preferences without consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file’s natural-language instructions are exclusively Chinese, which can impose a language constraint on users or downstream agents without any opt-in or alternative locale guidance. The policy allows locale constraints when they are explicitly justified or optional, but this file does not state such a limitation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sources.md (reported line 56)May include surrounding context.

md

### GDELT

- DOC 2.0：`https://api.gdeltproject.org/api/v2/doc/doc`
- 用于全球事故、供应链、监管和地缘事件发现。
- GDELT Cloud 新 API 需要用户自己的 Key；没有 Key 时不要尝试受限端点。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generated prompt is entirely in Chinese and the file provides no option for the user to choose another language or locale. This creates a natural-language policy concern because it forces a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language description presents the skill entirely in Chinese, which may imply a fixed language expectation without user opt-in. Under the language/locale policy, forcing a specific language is only acceptable when the skill offers choice or clearly documents a justified region-specific constraint.

Content

No source excerpt is available for this finding.