东方财富妙想资讯搜索

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:25 PM UTC
• Version:
  1.0.0

Overview

This skill is a straightforward financial news search helper that uses a user-provided API key to query an external Eastmoney-related search endpoint.

Install only if you are comfortable obtaining and storing MX_APIKEY locally and sending your financial search queries to the external search service. The maintainer should declare bash, curl, network access, and MX_APIKEY in metadata, and should improve JSON escaping for unusual query text.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill instructs the agent to invoke a shell script (`scripts/search_news.sh <查询内容>`) but does not declare any permissions for shell/code execution. That mismatch is a real security issue because it can lead to undeclared command execution capability and reduce the platform's ability to gate, audit, or sandbox risky operations. In this context, the query content is user-influenced and the skill accesses external data via an API key, which increases the need for explicit permission declarations and safe command handling.

VirusTotal

65/65 vendors flagged this skill as clean.