小果全能大QMT量化交易助手

• Outcome: Review
• Latest audit: Sep 1, 2026 · 2:53 AM UTC
• Version: 1.0.0

Overview

The skill is a real trading-code assistant that includes live-order and account-operation templates, but it lacks enough safeguards around financial actions and account data.

Install only if you intentionally want an assistant that can help produce QMT live-trading code. Treat every generated strategy as capable of real financial action, review all passorder/order/cancel/repayment code manually, replace hardcoded account values with secure local configuration, avoid sharing account identifiers or membership credentials in prompts or code, and test in simulation before any funded account use.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (411)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence
• Finding: The skill is presented as a general assistant but embeds extensive concrete trading workflows, including direct order placement, immediate execution modes, callbacks, timers, and live-account operations. That mismatch can cause users or downstream agents to invoke the skill in a higher-trust 'advisory' context while it provides operational content suitable for real-money trading, increasing the chance of unsafe automation or unreviewed execution.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This callback-reference documentation includes an actual passorder() example in after_init, which goes beyond explaining callback behavior and can be copied into a live-trading strategy with minimal modification. In the context of a skill whose purpose is generating QMT strategy code, embedding executable order placement in reference material increases the chance of unintended real-money trades by users or downstream agents.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The task_callback reference repeats the same live order placement pattern even though the section is supposed to document callback semantics, not trading actions. Repetition across multiple callback sections normalizes executable trade placement as boilerplate, which is dangerous in a skill designed to help generate production QMT code.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The order_callback documentation includes executable order placement unrelated to the minimal explanation needed for handling order status updates. Because this skill is a quant trading assistant for real QMT workflows, users may reasonably treat the sample as safe default code and trigger real orders during setup or testing.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The deal_callback section embeds passorder() merely to cause a callback, introducing an unnecessary trading side effect into explanatory documentation. In a live-trading assistant context, examples that cause executions are particularly risky because a copied snippet can lead directly to unintended market orders and financial loss.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The position_callback reference includes order submission even though position-change handling can be documented without any trade initiation. The surrounding skill context makes this more dangerous because it is positioned as a professional-grade assistant that auto-generates QMT strategies, so embedded trading snippets are likely to be reused verbatim.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Even the abnormal-order callback sample performs order submission, meaning the documentation induces a potentially real failed or unintended order just to illustrate error handling. This is dangerous because users may copy the snippet into live environments, causing account activity, failed orders, or accidental execution if parameters are changed.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The code embeds a specific trading account identifier directly in the skill logic, which is sensitive operational data and should not be hard-coded into distributed strategy examples. In a trading-assistant skill, this is more dangerous because generated or reused code may be run in live environments, causing accidental use of the wrong account and exposing account information to anyone who can view the file.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file contains executable QMT logic that schedules and performs real credit-debt repayment actions via `passorder`, rather than merely documenting or generating example strategy code. In the context of an assistant skill, embedded live-trading behavior is dangerous because it can trigger real financial account operations if reused, loaded, or adapted by a user without understanding that it is not a passive reference.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This section directly queries a credit account, calculates available funds and debt balances, and submits repayment orders to the brokerage account. That exceeds the stated role of a development assistant and creates a clear path from reference material to unauthorized or accidental financial operations, especially in a skill meant to auto-generate QMT code from natural language.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file is framed as a learning/support assistant, but the implementation directly submits live IPO subscription orders via passorder using a hardcoded account identifier. This mismatch is dangerous because users may invoke or reuse the skill expecting advisory behavior while it performs real trading actions with financial consequences.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The inline description says the content is for learning use and risk awareness, yet the code actively fetches IPO data and places orders for each eligible stock. Presenting executable trading automation as educational content increases the likelihood of accidental deployment and unauthorized or unintended trades.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The file presents itself as a code-support/assistant artifact, but the implementation is an executable trading strategy that can place real orders via `order_shares`. This mismatch is dangerous because users or downstream systems may grant it lower scrutiny or run it in contexts intended for advisory logic, leading to unintended live market activity.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The documented purpose says the component provides code assistance and optimization, but the code actually performs automated VWAP-style order execution. In a skill ecosystem, this kind of capability mismatch increases the chance of accidental deployment, unsafe trust decisions, or inclusion in environments where live trading behavior is unexpected.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The example is explicitly for a real-trading callback flow and includes a direct passorder call after setting a live account, yet the surrounding commentary downplays the consequence by emphasizing editor behavior. In a quant trading assistant, users may copy-paste examples into production-like environments, causing unintended real orders and direct financial loss.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: This task callback example again embeds a real order submission while the explanatory text softens the operational risk. Because the skill is designed to generate and teach QMT trading code, unsafe examples are especially likely to be reused against funded accounts.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The order status callback sample contains executable trading logic that can submit a live order, while the surrounding notes do not clearly disclose that the example itself has a real side effect in the intended runtime. This mismatch can mislead users into executing code they perceive as observational or diagnostic only.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The deal callback documentation includes a live order example without candidly stating the real-trading effect at the example location. In the context of automated trading callbacks, such code can create accidental trades or feedback-loop behavior if users adapt it directly.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The position callback sample mixes passive state-handling documentation with active order placement, and the notes do not fully disclose this side effect where users are most likely to copy the code. In a live brokerage-connected strategy environment, this can trigger unintended market activity and monetary harm.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: Even the abnormal-order callback example submits an order while presenting itself as error-handling documentation, which is particularly hazardous because users may assume it is safe diagnostic code. This can cause real trades in the very environments where users are troubleshooting live account issues.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The code comments and branch logic imply a comparison between Shanghai and Shenzhen reverse-repurchase instruments, but both variables are hard-coded to the same Shenzhen symbol. In a live trading skill, this creates misleading behavior and can cause the strategy to select, price, and trade the wrong market product while the operator believes cross-market logic is in effect.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The document explicitly teaches and exemplifies real trading and live-order placement, including immediate order submission and account interaction. In the context of an agent skill that can generate or guide code, this materially expands capability from advisory help into potentially account-impacting actions, creating risk of unauthorized or unsafe financial operations if invoked without strong gating.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The file includes APIs for creating folders/sectors and modifying watchlist or sector membership, which are state-changing actions outside a narrow strategy-assistant role. While not as severe as trading, these actions can alter a user's workspace and investment organization without clear necessity or consent, increasing the blast radius of misuse.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: The ability to create and write custom extension data allows persistent state changes beyond simple strategy assistance and may be abused to stash opaque data, influence downstream models, or alter local analytical outputs. In a skill intended mainly for strategy development help, this is broader-than-necessary write capability.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Token-based xtdatacenter usage introduces remote connectivity and credential-bearing workflows not clearly required for a local strategy-development assistant. If misused, it could expose tokens, expand access to external data services, or enable unintended data exfiltration and privileged remote operations.

Static analysis

No suspicious patterns detected.