A Stock Holding Monitor

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:40 PM UTC
• Version:
  1.0.0

Overview

This is a straightforward local A-share holdings monitor, with a privacy caveat because it saves recent portfolio status in a temporary file.

Install only if you are comfortable putting your holding details into the script. On a shared or multi-user machine, change the output path from /tmp/holding_check.json to a private user directory with restrictive permissions before running it from cron.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script persists detailed holding status, including prices, profit/loss, support, stop-loss, and trading signals, to /tmp/holding_check.json even though the skill is presented as a monitoring/reminder tool. Writing sensitive financial data to a world-accessible temporary location can expose portfolio information to other local users or processes and creates unnecessary data retention.

VirusTotal

65/65 vendors flagged this skill as clean.