Security audit

小果基金量化分析助手

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed quant-analysis API manual, but it grants broad credentialed network, code-submission, deletion, and file-write capabilities that are under-scoped for a fund-analysis skill.

Review carefully before installing. Only use this with a server and account you trust, avoid entering valuable credentials over non-HTTPS connections, do not run the bundled scripts on sensitive directories, and treat delete-all, community publishing, strategy execution, and custom-code data calls as high-impact actions requiring explicit human confirmation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill embeds code and examples with capabilities beyond a pure documentation artifact, including local file/database path access such as `get_user_base_data(file_path=...)` and custom code that can read or write data remotely. Because the manifest declares no permissions or safety boundaries, users and hosting platforms are not warned that the skill can drive file-like data access behaviors.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The manifest presents this as a fund quant-analysis assistant, but the embedded documentation expands into stocks, convertible bonds, indexes, minute-level data, and financial statements. This scope mismatch increases the chance that a user or orchestrator will invoke powerful capabilities that were not expected, reviewed, or consented to.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The code exposes simulation, community-strategy publication, execution, retrieval, and deletion operations that are not described in the fund-analysis manifest. Hidden management and state-changing features materially expand risk because they allow persistent remote actions rather than passive analysis only.

Context-Inappropriate Capability

Critical

Confidence: 99% confidence
Finding: The `get_user_def_data` interface accepts arbitrary code in the `func` parameter and forwards it to a remote endpoint, which is a classic remote code execution/enabled code-submission pattern. In the context of a fund-analysis skill, this is unjustified and could be abused to run unauthorized code, access sensitive data, or pivot within backend infrastructure.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill includes remote deletion functions for single and all simulation/community strategies, which are destructive state-changing operations unrelated to a narrowly scoped analysis assistant. If triggered accidentally or maliciously, they can cause irreversible loss of user strategies or shared community content.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The documentation claims the tool only supports ETF fund data, yet elsewhere documents and exposes stock and convertible-bond support. This inconsistency can mislead reviewers and users about the real attack surface, undermining trust and safe policy enforcement.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: In the single-thread path with async I/O enabled, the code only preloads raw market data via get_stock_data() and writes it directly to 全部因子数据, but never invokes xg_factor or any factor-calculation routine. This silently produces mislabeled output that appears to be computed factor data, which can corrupt downstream research, backtests, or investment decisions without obvious runtime failure.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The params_data helper opens an attacker-controlled input path and writes generated output to an attacker-controlled destination path without scope restriction, validation, or confirmation. In an agent skill intended for fund quant analysis, this expands capability into arbitrary local file transformation and overwrite, which could damage files or be abused to stage unwanted code artifacts if the skill is invoked on sensitive paths.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: This helper provides general local file read/write and code-generation behavior that is broader than the stated analytics purpose of the skill. Even without direct code execution here, converting arbitrary files and emitting runnable Python to arbitrary locations increases the attack surface and creates an avenue for unintended file access, overwrite, or downstream execution by other components.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: In the async branch of the so-called single-thread all-factor workflow, the code only preloads raw stock data via get_stock_data() and then writes that dataframe directly to 全部因子数据 as if factor computation succeeded. This silently produces incorrect output files, corrupts downstream analytical results, and can overwrite previously correct factor datasets with raw data under trusted filenames.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The implementation labels simple data preloading as successful factor computation, increments success counters, and persists the wrong artifact. This creates a false sense of correctness and can mislead users into acting on incomplete or invalid quantitative outputs, which is especially risky in an investment-analysis skill where users may trust generated factor data for decisions.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The params_data helper reads a user-supplied file, transforms its contents into Python-like code, and writes the result to an arbitrary caller-controlled path. That exceeds normal analytics behavior and creates a local file write/code-generation primitive that could overwrite project files or produce executable code later consumed elsewhere.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: This function converts external formula text into Python syntax and saves it as a runnable file, effectively enabling code generation from untrusted input. Even if it does not execute the output directly, generating code artifacts from attacker-controlled text is risky because downstream tooling or users may later import or run the generated file.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation instructs users to supply `user`, `password`, and `auth_code`, and the client transmits them to a remote server over a base URL constructed with plain HTTP. Without explicit warning or transport safeguards, this creates credential-exposure risk through interception, logging, or accidental disclosure.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The markdown describes destructive deletion capabilities but does not warn users about permanence, scope, or recovery limitations. In a skill that also supports bulk deletion, lack of warning materially increases the likelihood of accidental data loss.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The entrypoint enables force_recalc=True by default, causing previously generated factor files to be recomputed and overwritten without an interactive confirmation or safety check. In a research workflow, this can destroy prior results, break reproducibility, and lead to accidental loss of derived datasets when the script is run unintentionally.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The function writes to disk immediately using the supplied output path and truncates the target file with no prompt, confirmation, or safety check. In an agent environment, silent file modification is dangerous because a user may supply or an upstream tool may pass a sensitive path, causing accidental data loss or unauthorized alteration of local files.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code opens the caller-supplied output path with 'w+' and truncates it immediately, with no warning, confirmation, or overwrite protection. In an agent setting, this can destroy arbitrary local files if the path is influenced by a user or another untrusted component.

Missing User Warnings

Low

Confidence: 76% confidence
Finding: The helper reads from a caller-controlled local path without any disclosure or apparent restriction. In isolation this is a limited local file read primitive, but in an agent skill it increases risk because the skill's stated purpose is fund analysis, not arbitrary filesystem access, so users may not expect sensitive local files to be reachable.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.