Security audit

小果量化因子库

Security checks for vulnerabilities and agentic risk

Overview

This is a local quantitative-analysis skill that writes factor result files, with no evidence of credential access, network exfiltration, or persistence.

Install this only if you want a Chinese-language quantitative factor toolkit. Run it in a dedicated project directory, review output paths before batch jobs, avoid force recalculation unless overwriting result files is acceptable, and treat generated formula output as untrusted code unless you review it first.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The activation list includes generic phrases such as “量化因子”, “因子计算”, “技术指标”, and “因子库”, which are broad terms a user might naturally use in ordinary financial discussion. The file does not provide exclusion conditions, negative examples, or a narrower invocation context, so the skill could be invoked unintentionally.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The docstring claims this method performs '死叉判断', which semantically means detecting a downward crossover. But the body calls `CROSS(MA(self.C, n1), MA(self.C, n2))`, the same upward-cross function used by `CROSS_UP`, so the documentation and code intent diverge.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill includes `params_data`, which reads an arbitrary local formula file and writes a generated Python-like output script to a caller-controlled path. In a skill advertised as a factor-computation library, this expands behavior into file transformation and code generation, creating unexpected file write capabilities and increasing the risk of unsafe downstream execution of generated content.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The comments describe `平空开多` as MACD crossing above 0 and `平多开空` as 0 crossing above MACD. But the code assigns `平空开多` twice and returns it for both output slots, so the documented two-signal intent is contradicted by the implementation.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The implementation writes and overwrites many local artifacts such as parquet, JSON, and Excel files across multiple directories, while the skill is primarily presented as an analysis library. This mismatch can lead to unintended data modification, disk consumption, and silent overwriting of existing files when invoked in automated environments.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The skill name, description, trigger keywords, and user-facing documentation are all presented in Chinese, with no indication that other languages are supported or that the user can choose a preferred language. This creates a language/locale constraint without explicit user opt-in.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: The skill description does not clearly warn that examples and workflows write multiple files to disk. In an agent setting, omission of write-side-effect disclosure can lead users or orchestrators to invoke the skill under the false assumption that it is read-only analysis, increasing the chance of unintended local modification.

Intent-Code Divergence

Low

Confidence: 99% confidence
Finding: The method name and logic indicate a KDJ dead cross (`CROSS(D, K)`), but the docstring explicitly labels it as `KDJ_KD金叉`. This is an active contradiction in the inline documentation, not merely missing detail.

Intent-Code Divergence

Low

Confidence: 99% confidence
Finding: The implementation computes `CROSS(RSI2, RSI1)`, which is intended as a dead-cross condition, but the docstring says `RSI_金叉`. That creates a direct mismatch between the method’s stated purpose and its actual logic.

Intent-Code Divergence

Low

Confidence: 99% confidence
Finding: The method computes `CROSS(DEA, DIF)`, which corresponds to a dead cross, but its docstring says `MACD_金叉`. This contradicts the function’s name and code path.

Intent-Code Divergence

Low

Confidence: 99% confidence
Finding: The implementation detects `CROSS(PSYMA, PSY_1)`, which represents a dead cross, but the docstring labels it as `PSY_金叉`. This is a direct contradiction between documentation and behavior.

Static analysis

No suspicious patterns detected.