小果可转债量化分析助手

• Outcome: Review
• Latest audit: Sep 2, 2026 · 1:50 AM UTC
• Version: 1.0.0

Overview

The skill is a financial analysis client, but it exposes broad authenticated market-data, strategy-management, deletion, custom-code, and local file-writing capabilities that are not safely scoped for its stated convertible-bond focus.

Review this skill carefully before installing. Use it only with a trusted server, prefer HTTPS, do not place real passwords or authorization codes in examples or logs, and require explicit confirmation before any strategy creation, publication, deletion, bulk deletion, custom-code, or local file-writing action. Keep backups of strategy and factor data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill is presented as a narrow convertible-bond quant assistant, but the bundled content exposes much broader stock, ETF, index, finance, and strategy-management capabilities. This scope mismatch weakens user trust boundaries and can cause the agent to invoke privileged or risky operations that users would not reasonably expect from the declared purpose.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The documentation and code expose a general-purpose market-data and financial-analysis client, not just convertible-bond tooling. This hidden expansion of scope increases the chance of unintended data access, misuse of unrelated endpoints, and user confusion about what actions the skill may perform.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The skill includes creation, publication, and management of simulated and community trading strategies even though it is described primarily as an analysis and backtesting assistant. These state-changing operations can have external effects, including publishing strategies or modifying shared records, beyond what a user would expect from a read-oriented analysis tool.

Context-Inappropriate Capability

Critical

• Confidence: 98% confidence
• Finding: The skill exposes destructive deletion endpoints for simulated and community strategies, including bulk deletion, inside a skill framed as an analysis assistant. If invoked accidentally or maliciously, these operations can irreversibly remove user or shared strategy data and cause operational disruption.

Context-Inappropriate Capability

Critical

• Confidence: 99% confidence
• Finding: The get_user_def_data interface sends arbitrary code strings to a server-side endpoint for execution or evaluation. This is effectively a remote code execution surface: an attacker could submit malicious code to access server resources, exfiltrate data, pivot internally, or disrupt service.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: In the async branch of the single-thread staged calculation path, the code only calls get_stock_data() and immediately writes the returned raw dataframe to 全部因子数据, bypassing _calculate_single_stock_sync() and therefore skipping all factor computation. This silently produces incorrect outputs that look like completed factor datasets, which can poison downstream quant research, backtests, or trading decisions without obvious detection.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The params_data function reads from a caller-supplied path, transforms the file contents, and writes generated Python-like output to another caller-supplied path. In an analytics skill focused on convertible-bond research, source-to-source conversion and arbitrary file output exceed the expected scope and create a file-system side effect that could overwrite local files or plant generated code for later execution.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The same params_data routine acts as a code-generation utility by converting formula syntax into Python-style assignments and persisting the result to disk. Even without immediate execution in this file, generating code artifacts from untrusted input increases the risk of downstream code execution or unsafe reuse, and it is not necessary for the stated bond-analysis functionality.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The params_data helper reads an arbitrary local file path and writes transformed output to another arbitrary local path. In a skill advertised for quantitative bond analysis, this expands the capability surface into filesystem access and code-generation-like behavior, which can be abused to overwrite local files or process unintended inputs if exposed through agent-controlled parameters.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The same helper is effectively a generic Tongdaxin formula translator that rewrites formula text into Python-like code and emits it to disk. Even without direct execution in this file, code-emission primitives are risky because they create artifacts that may later be imported or run, enabling unsafe workflows beyond the stated analytics purpose.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The examples normalize passing user, password, and auth_code into requests over a base URL constructed with plain HTTP, without warning users about credential exposure. This encourages insecure handling of secrets and raises the risk of interception, leakage in logs, or accidental disclosure through copied examples.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The documentation presents destructive deletion operations as routine examples without caution, confirmation guidance, or rollback expectations. This increases the likelihood of accidental misuse, especially in an agent setting where users may not realize the action is irreversible.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The main entry point enables force_recalc=True, which causes previously computed parquet outputs to be overwritten automatically with no runtime confirmation or safety interlock. In a data-analysis skill, this can destroy prior results, mask accidental reruns, and make rollback or audit of historical factor data difficult.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The function performs file writes immediately to a user-controlled destination path with no confirmation, prompting, or safety guardrails. In a skill advertised as an analysis tool, silent writes are more dangerous because users would not reasonably expect the component to modify local files, increasing the chance of accidental overwrite or persistence of unsafe generated artifacts.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The function opens and reads a caller-controlled path without validation or disclosure. While simple file reading is not always dangerous, in this skill context it expands the tool from market analytics into local file access, which can expose unintended files if an attacker can influence the path or if users do not understand the side effects.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The function opens the destination path with write/truncate semantics and overwrites existing content without warning. If a caller can influence to_path, this can destroy or replace local files, which is an integrity risk even if the file contents are only transformed formula output.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.