Eastmoney News

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do the advertised finance-news search, but it publishes a shared API key and sends search terms to a hardcoded external service without clear user controls.

Install only if you are comfortable with finance search terms being sent to the Eastmoney API. The publisher should rotate the exposed key and move authentication to a managed or user-provided credential before broad use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to send user-provided search queries to a remote third-party API but does not disclose that transmission to the user or require consent. This creates a privacy and data-handling risk because users may provide sensitive investment interests or other confidential text that is silently exfiltrated to an external service.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code sends both a user-supplied query and an authentication header to a third-party API, but it hardcodes the API key and provides no consent, disclosure, or control around outbound data transmission. This creates a real risk of secret exposure, unauthorized API use, and unintended transmission of potentially sensitive user queries to an external service.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal