Liangxi News Skill

• Outcome: Review
• Latest audit: May 29, 2026 at 9:36 PM UTC
• Version:
  0.6.0

Overview

This skill is mostly transparent, but it can route generic news requests into a third-party TradeAlpha service that may ask for credentials and store a token locally.

Install only if you intend generic news requests to use TradeAlpha and you trust quantaccess.lxaa.top and the separate plugin providing tradealpha_news and tradealpha_login. Prefer a scoped TRADEALPHA_API_KEY over typing a password, and remove the local config file if you do not want the token persisted.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list is very broad and matches common, generic news requests like 'today's news' or 'latest news', causing this third-party skill to intercept ordinary user intents that may have been meant for safer or more general capabilities. In context, this is more dangerous because the skill routes users toward an external host and may subsequently request credentials or use locally stored tokens, increasing the chance of unintended data flow to the plugin backend.

VirusTotal

62/62 vendors flagged this skill as clean.