Stock Realtime Brief

• Outcome: Review
• Latest audit: Jul 6, 2026 · 6:10 PM UTC
• Version: 5.5.0

Overview

This is a coherent A-share analysis skill, but it includes under-scoped credential use, hard-coded portfolio paths, persistent monitoring, and QQ message sending to a fixed chat target.

Review carefully before installing. Treat this as a personalized trading assistant, not a passive stock viewer: configure or remove the hard-coded QQ chat ID, watchlist, secret-file paths, and portfolio paths, and only run push/watch modes if you understand what data may leave the machine and where alerts will be sent.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (47)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--target", USER_CHAT_ID,
            "--message", message,
        ]
        r = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        return r.returncode == 0
    except:
        return False

• Confidence: 90% confidence
• Finding: r = subprocess.run(cmd, capture_output=True, text=True, timeout=30)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no permissions while the documentation clearly describes capabilities that touch sensitive resources: environment variables, filesystem reads/writes, network access, and shell execution. That mismatch is dangerous because it prevents proper sandboxing and informed consent, and in this context the skill also references portfolio data, API keys, background monitoring, and external command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior exceeds the declared A-share analysis purpose by including GitHub publishing helpers, QQ messaging, persistent local storage, and invocation of external CLIs and scripts. This broadens the attack surface substantially: a user may invoke what appears to be an analysis skill, but it can also exfiltrate data, persist state, or trigger external side effects unrelated to core stock analysis.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The skill is presented as analysis-only, but the commands include QQ push delivery and background watch/alert automation. That matters because outbound notifications and daemonized monitoring create persistent, external side effects beyond passive analysis, which can leak trading interests or operate without immediate user awareness.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: The documentation says the skill is not responsible for stock recommendation, yet the same file advertises integrated stock-picking commands and ranking flows. This contradiction is risky because users and enforcement layers may treat the skill as informational while it actually performs recommendation-like behavior, increasing compliance, trust, and misuse risk.

Intent-Code Divergence

High

• Confidence: 89% confidence
• Finding: The file states the skill does not do stock screening, but elsewhere says stock screening is integrated. In a financial-analysis context, this inconsistency is more dangerous because it obscures actual decision-support behavior and can bypass policy or user expectations about what the skill is allowed to do.

Intent-Code Divergence

Medium

• Confidence: 72% confidence
• Finding: One section forbids direct buy/sell wording in multi-stock mode, while a later scoring rubric maps outputs to 'strong buy/add' and 'strong reduce/liquidate'. This inconsistency can cause the agent to emit more directive trading advice than intended, which is especially sensitive in a financial skill where language constraints are part of the safety boundary.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The watchlist embeds personalized trading instructions and position sizes instead of limiting itself to neutral alerting. In an agent skill, this can drive unauthorized or overly specific financial actions, increasing the chance of harmful automation, unsuitable recommendations, or accidental execution beyond the skill’s stated briefing/monitoring role.

Description-Behavior Mismatch

Low

• Confidence: 89% confidence
• Finding: The configuration stores user-identifying ownership metadata, including a personal name and a chat-linked owner identifier, which is not necessary for a stock alert definition. If exposed through logs, backups, prompt leakage, or tool output, this creates avoidable privacy risk and can facilitate profiling or cross-system correlation of the user.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The module reads a local secrets file to obtain an API key and then uses it for outbound requests, even though this behavior is not disclosed in the module interface or obvious from the stated stock-analysis function. Secret access expands the skill's privileges and can surprise operators, increasing the risk of unauthorized credential use or unintended data egress.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The module reads an API key from a local secrets file and uses it to call an external service. While external search is related to the stock-analysis purpose, directly accessing a platform-local secret path creates unnecessary credential exposure and couples the skill to privileged local resources that a skill should not assume it can read.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The module reads a local secrets file to obtain an API key and then uses that credential for outbound requests. Even though it does not exfiltrate the key directly, this creates secret-dependency behavior inside the skill without clear user awareness, and in agent environments it can cause unintended use of host-provided credentials or expand trust boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code reads a local secret from /home/work/.openclaw/secrets/tinyfish.env and uses it to send stock-code-based queries to a third-party search API. In a stock briefing skill, silently consuming platform secrets and exporting query data to an external service is a real capability expansion and can violate least-privilege and user expectations.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: Executing an external CLI tool (gsk search) gives the skill an unnecessary capability to invoke local binaries and interact with whatever environment that tool can reach. Even without shell injection, this is dangerous because it broadens trust boundaries, may leak queries or environment-derived data, and is not justified by the skill's core A-share briefing purpose.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: This module is presented as a stock analysis/briefing skill, but it includes autonomous outbound QQ push behavior. That is a scope expansion because it performs an external side effect not inherent to local analysis, increasing privacy and abuse risk if triggered unexpectedly.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: Executing an external subprocess to send QQ messages gives the skill a powerful action channel beyond its stated stock-picking purpose. In the skill context, this is more dangerous because a finance analysis tool should not silently gain arbitrary outbound execution/integration capability, which could be repurposed for data exfiltration or spam.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code reads portfolio data from a hard-coded path outside the module’s own data area, coupling this skill to unrelated workspace data. In context, this is unnecessary privilege expansion for a stock briefing tool and creates a privacy boundary violation even if only symbols are used.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The README states that the tool automatically fetches real-time quotes and recent announcements, but it does not clearly disclose that using the skill will initiate outbound network requests to third-party financial data providers. Users may unknowingly transmit stock tickers and portfolio-derived query context to external services, which is a transparency and privacy issue even if the data is not highly sensitive by itself.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This section explicitly permits highly concentrated positions and discusses use of margin/shorting with only minimal caveats, while the skill is marketed to retail investors and lacks a clear user-facing financial-risk disclaimer. In this context, the content can normalize aggressive leveraged trading behavior and increase the chance that users follow hazardous strategies without understanding drawdown, liquidation, or suitability risks.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The document provides concrete, structured buy/sell instructions, including entry price, position sizing, profit targets, stop-loss rules, and execution conditions, but does not include an explicit financial-risk disclaimer or limitation that this is not individualized investment advice. Because the overall skill is positioned as a real-time A-share decision system for retail users, this prescriptive guidance is more dangerous than generic education and could directly influence risky trades.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The promotional content emphasizes 'actually executable' trading recommendations and direct-copy conditional orders, but some variants omit or minimize financial-risk warnings. In the context of an A-share retail trading tool, this can encourage overreliance on automated outputs and create user-harm, regulatory, or compliance exposure if users treat marketing claims as personalized or low-risk trading advice.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Reading an API key from a local secrets file without any user-facing disclosure is a security-relevant transparency failure. In an agent skill context, hidden credential use is more dangerous because users may not expect the skill to access host secrets at all, and this pattern can normalize overprivileged skills.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code sends user-derived query data to an external service together with an API credential, but there is no clear disclosure, consent, or controls around this outbound transmission. In a stock-analysis skill, this creates data egress risk and may expose sensitive watchlists, analysis targets, or usage patterns to a third party.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code persistently writes trading plan data to disk under a predictable local path without any disclosure, consent, retention control, or access protections visible in this file. Even though this is not overtly malicious, it can expose sensitive financial intent and portfolio information to other local users, backup systems, logs, or unintended operators if the environment is shared or insufficiently secured.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code sends user-influenced stock names and search queries to an external API without any disclosure or consent mechanism. Even if the data is not highly sensitive in many cases, it leaks user activity, interests, and prompts to a third party and expands the skill's data-sharing surface.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.