Security audit

A Share Guard

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent stock-risk analysis skill, but its reports can be incomplete and should not be treated as investment advice.

Install only if you are comfortable letting the skill run bundled Python scripts and fetch public finance websites. Prefer explicit /guard use, do not rely on generated ratings for trading decisions, and replace or remove the private browserless/CDP URL unless it points to your own isolated browser instance.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 84% confidence
Finding: The skill advertises a bounded stock-risk diagnostic function, but the documented behavior expands to outbound requests to third-party financial APIs, use of a scraper with browserless/CDP support, and arbitrary text sentiment analysis. That mismatch is dangerous because it broadens the trust boundary: users and policy engines may authorize a seemingly narrow finance skill while it can access more network resources and process freer-form inputs than expected, including potential access to internal/local services via the referenced local browserless endpoint.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The manifest requests the `exec` tool for a finance-focused stock risk diagnosis skill, but the metadata provides no clear operational need for shell execution. Granting command execution to a skill that primarily appears to analyze securities data unnecessarily expands the attack surface and could enable arbitrary local command execution if later prompts, fetched content, or tool calls are influenced by untrusted input.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The file-level docstring promises a three-layer consensus gate, but the implementation only consumes two scores and still emits authoritative recommendations. In a financial risk-diagnosis skill, this mismatch can mislead downstream users or agents into trusting a stronger validation process than actually exists, causing unsafe investment guidance based on incomplete checks.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The function claims that only 'three-layer agreement' leads to a normal rating, but the code defaults to normal rating for any case not matching two hard-coded divergence patterns. That means inconsistent states can be silently treated as consensus, weakening the decision guardrail and potentially suppressing warnings in a finance-oriented safety skill.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The three radar indicator functions are presented as if they use Eastmoney F10/financial sources, but they only return placeholder 'pending' data and empty values. In a financial risk-diagnosis skill, this can mislead users into trusting incomplete analysis and receiving 'safe' or understated risk results because critical inputs are never actually collected.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The README advertises broad natural-language triggers such as asking whether a stock 'has mines' or to 'help avoid landmines,' which can overlap with ordinary conversation and cause the skill to activate unintentionally. In a finance context, unintended invocation can expose users to unrequested investment-risk analysis or cause the agent to act on ambiguous requests, increasing the chance of misleading or inappropriate financial guidance.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: The natural-language triggers are broad enough to activate on ordinary stock discussion, which can cause the skill to invoke network searches and local execution unexpectedly. In a skill with exec and network-capable tools, overbroad triggering increases the risk of unintended tool use, surprise data egress, and user confusion about when analysis is being performed.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file provides concrete investment action guidance such as '减仓30%' and '可持有' without any financial-risk warning, suitability caveat, or statement that the content is informational only. In a stock-risk analysis skill, users may treat these outputs as personalized or authoritative advice, increasing the chance of harmful financial decisions and potential compliance issues.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: references/config-template.json:39