Security audit

Prosperity Investing Framework

Security checks for vulnerabilities and agentic risk

Overview

This stock-analysis skill is not malicious, but it should be reviewed because it can automatically process reports and change persistent investment tracking files and stock pools without clear per-action approval.

Install only if you want an opinionated Chinese stock-analysis workflow that may update local investment tracking records. Before use, require explicit confirmation before processing external reports or links, before writing to investment files, and before changing any stock pool; treat the trading language as educational analysis, not personalized financial advice.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (14)

Vague Triggers

High

Confidence: 98% confidence
Finding: The SOP states that receiving almost any report, research document, file, link, or text request should automatically trigger the workflow without user reminder. In combination with persistent archival steps, this creates an overly broad and potentially unsafe auto-run path that can be exploited to force the agent into unintended processing and record updates.

Ae1

High

Category: analysis-evasion
Content: **评估流程**：读取 `SKILL.md` → 六维评分 → 若满足则加入 `大开门股票池.md`，同时从备选池移至「已升入核心池」备注栏。
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: **评估流程**：读取 `SKILL.md` → 六维评分 → 若满足则加入 `大开门股票池.md`，同时从备选池移至「已升入核心池」备注栏。
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger list is very broad and overlaps heavily with ordinary investing conversation, making accidental invocation likely. Over-broad activation is dangerous here because the skill contains extensive autonomous workflow instructions, so a normal market discussion could unintentionally invoke file-handling and tracking behavior.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill is framed as an investing-analysis aid, but it also instructs the agent to persistently modify multiple local tracking files and archives. That expands capability from analysis into autonomous stateful data management, creating unnecessary risk of unintended file writes, data pollution, and scope creep if triggered in the wrong context.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The SOP auto-triggers on virtually any report, file, link, or research-related text and directs the agent to ingest and process arbitrary inputs automatically. This broad autonomous activation can cause unintended handling of untrusted content and execution of workflow steps beyond the user’s requested scope, increasing prompt-injection and overreach risk.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill authorizes the agent to autonomously maintain stock pools and promote companies between tiers based on repeated mentions or inferred scoring changes. This grants persistent decision-making power unrelated to simple framework guidance and can silently alter future recommendations or records without clear user approval.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all user-facing content in Chinese only, with no indication that the user can choose another language and no documented reason that the skill is region- or locale-specific.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The file gives explicit trading actions such as buying before earnings and selling or exiting before anticipated misses, but it does so without any warning that the material is investment analysis and may materially affect a user's finances. Because the skill is specifically framed as an investing framework, users are likely to treat these instructions as actionable advice rather than educational commentary, increasing the chance of financial harm from overreliance on speculative forecasts.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: This section presents concrete position-taking guidance, including timing ('4-5月布局'), holding periods, reduction of positions, and exit behavior, without any caution about risk, uncertainty, or suitability. In the context of a dedicated stock-investing skill, these examples function as de facto trading recommendations and could prompt unsafe financial decisions by users who assume the framework is reliable or authoritative.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The file title and all instructional content are written exclusively in Chinese, with no indication that language selection is optional or that the skill is region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all skill content in Chinese and does not provide an opt-in, alternative language, or justification that the skill is intentionally region- or language-specific.

Natural-Language Policy Violations

Low

Confidence: 91% confidence
Finding: This markdown file is entirely presented in Chinese beginning with the title at L001, and nowhere in the document offers an alternative language option or user opt-in. Under the stated policy, forcing a specific language without user choice is a natural-language locale policy violation.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This reference material presents all instructions and content solely in Chinese, and nowhere indicates that the skill is region-specific or that users may choose another language.

Static analysis

No suspicious patterns detected.