小果股票量化分析助手

• Outcome: Review
• Latest audit: Sep 2, 2026 · 1:57 AM UTC
• Version: 1.0.0

Overview

The skill is mainly a stock quant tool, but it also sends credentials and code to a remote HTTP service and can create or delete persistent strategy records.

Review before installing. Only use this with a server and publisher you trust, avoid sending real credentials over plaintext HTTP, require explicit confirmation before any create/delete strategy operation, and run the bundled scripts only in an isolated workspace with backups of any factor data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Description-Behavior Mismatch

High

• Confidence: 89% confidence
• Finding: The skill is presented as a stock analysis assistant, but it also exposes account-linked management of simulated and community strategy records. Hidden state-changing capabilities increase the risk of users invoking actions they would not reasonably expect from an analysis-focused tool.

Context-Inappropriate Capability

Critical

• Confidence: 98% confidence
• Finding: The skill includes destructive deletion endpoints for single and bulk strategy data, including community records, despite being framed as an analysis assistant. If triggered accidentally or by prompt confusion, these operations can irreversibly destroy user or shared strategy data and cause account-level integrity loss.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: Simulated trading and community publication/management go beyond passive analysis and create side effects on remote systems. In context, that is more dangerous because users invoking a 'quant analysis assistant' may not anticipate actions that create, publish, or alter persistent strategy state.

Context-Inappropriate Capability

Critical

• Confidence: 99% confidence
• Finding: The get_user_def_data interface accepts arbitrary code as a string and forwards it to a remote endpoint, enabling remote code execution-like behavior on the backend service. This is especially dangerous in an analysis skill because an attacker can disguise code execution as a harmless data query and potentially access server resources, secrets, or connected systems.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: In the single-thread staged path, the async I/O branch only calls get_stock_data() and then immediately writes that dataframe to 全部因子数据 as if factor computation had completed. This silently stores raw or partially processed market data in the factor-output location, creating integrity corruption that can poison downstream backtests, model training, and trading decisions without obvious errors.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The code comment says it is preloading data, but the implementation increments success counters and persists the preloaded dataframe as final output. This mismatch is dangerous because operators may believe factors were computed successfully when the system only performed data loading, leading to silent data-quality failures and unreliable quantitative analysis.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The `params_data` function performs arbitrary local file reads and writes based on caller-supplied paths, which exceeds the expected scope of a stock-analysis helper and creates filesystem side effects. In an agent/skill context, if untrusted input can control `test` or `to_path`, this can overwrite local files or read unintended content, especially because the function truncates the output file before writing.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The `params_data` function reads an arbitrary local file path and writes transformed output to an arbitrary destination path, truncating the destination file before writing. In a skill whose stated purpose is stock analysis, this local file modification capability is broader than necessary and can overwrite user files if exposed to untrusted input or invoked unintentionally.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: This code includes a local code-generation utility that converts formula text into Python-like output and saves it locally. That expands the skill from passive analysis into filesystem-affecting transformation tooling, increasing attack surface and enabling abuse for clobbering files or generating unsafe code artifacts from untrusted formula input.

Missing User Warnings

High

• Confidence: 93% confidence
• Finding: The examples show user credentials, auth codes, queries, and financial requests being sent to an external HTTP service, but the skill does not clearly warn users of that data flow. This can expose sensitive account and query data to interception or misuse, especially because the base URL uses plaintext HTTP rather than HTTPS.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill exposes deletion operations without clearly warning users that these actions are destructive and may affect personal or community strategy records. In a skill marketed for analysis, omission of destructive-operation warnings materially increases the chance of accidental data loss.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The conversion helper opens the destination with `w+` and explicitly truncates it, causing silent overwrite of any existing file. In a skill environment, this can destroy user or system data if the output path is influenced by input or defaults to an important location, making the file-writing behavior security-relevant rather than merely inconvenient.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The script enables force_recalc=True in the main entrypoint, causing broad overwrite of generated factor files across the data directory without any confirmation, dry-run, backup, or output isolation. In an agent skill context, this is more dangerous because execution may happen with valuable local datasets and minimal user visibility, making destructive or irreversible writes easier to trigger accidentally.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function opens the output path with `w+` and explicitly truncates it, overwriting any existing file without confirmation, backup, or safety checks. If an attacker or accidental caller controls `to_path`, this can destroy local data or replace important files within the process's permissions.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.