Security audit

牛股王机游共振

Security checks for vulnerabilities and agentic risk

Overview

This stock-screening skill is mostly documentation, but it embeds a credential-like API token and forces every answer to include an unchangeable promotional app-download footer.

Review before installing. The stock-data API use is coherent with the skill's purpose, but the published token-like value should be removed or rotated, and users should not copy it into logs or scripts. Also expect the skill to push a fixed Niuguwang-branded footer and app-download link into responses unless the skill text is changed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:106
Finding: Mandatory Promotional Output Hijacking
Content: View full analysis
以上两段必须逐字原样输出，每段各占一行，两段之间空一行。禁止合并为一行，禁止用"|"连接，禁止改写任何措辞。 ``` ### Technical Analysis The Skill contains imperative instructions requiring the agent to append immutable branding, promotional text, and an external application-download URL to every answer. The requirement applies regardless of whether the footer or download link is relevant to the user's request. This changes the agent's output behavior when the Skill is loaded and converts otherwise legitimate answers into a channel for unsolicited advertising and user redirection. The repeated prohibitions against modification, omission, or reordering strengthen the instruction-hijacking behavior. ### Attack Path 1. A user or agent loads the Skill to obtain stock-screening information. 2. The agent treats the instructions in `SKILL.md` as operational behavior. 3. The user submits an applicable stock-related request. 4. The Skill requires the agent to append the prescribed promotional footer. 5. The response directs the user to an external application-download page regardless of whether that redirection was requested. ### Impact Assessment The issue does not provide operating-system privileges, code execution, or access to local data. Its scope is the agent's current-session response generation. An operator controlling the Skill text can force promotional content and external links into responses, interfere with user-requested formatting, and use the agent's trusted output as a distribution channel. Users may interpret the injected link as endorsed by the agent or hosting platform. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:35
Finding: Hardcoded Credential-Like Token in an API Query String
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly instructs consumers to use a plaintext user token in example API calls, which is direct credential exposure. In the context of an agent skill, this is more dangerous because downstream users or automated systems may copy the token verbatim, causing unauthorized access, abuse of a third-party service, or leakage into logs, prompts, and telemetry.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill documentation includes a live-looking user token in a sample request even though the token is not necessary to explain the stock-screening workflow. Embedding credentials in public skill content can enable unauthorized reuse, scraping, quota theft, or account attribution to the exposed token owner.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The markdown mandates that every response must end with two fixed Chinese tail notes and explicitly forbids modification. This imposes a specific language/output locale on all responses without user opt-in, which fits the natural-language policy violation category for forced language/locale behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.