公司深度分析助手

• Outcome: Pass
• Latest audit: Aug 14, 2026 · 1:35 AM UTC
• Version: 1.0.12

Overview

This is a coherent investment-research skill that fetches public A/H-share market data and writes local reports, with disclosed network and file behavior plus some hygiene issues to consider.

Install only if you are comfortable sending company names, tickers, and related lookup terms to the listed public finance/search providers and having generated reports plus temporary JSON files written locally. In managed or confidential research environments, update dependency minimums, prefer a local copy of html2canvas, and clear temp/report outputs according to your retention policy.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill exercises powerful capabilities including shell execution, filesystem reads/writes, environment probing, and network access, yet declares no permissions or equivalent user-facing disclosure. This creates a trust and containment gap: users and hosting platforms may authorize the skill under false assumptions while it performs broader actions such as fetching remote data and writing files to /tmp.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The documented purpose emphasizes a company-analysis workflow, but the skill also exposes lower-level data-harvesting and valuation-script behaviors, batch quote/finance collection, and temp-file persistence that are not clearly presented as user-facing capabilities. This mismatch can lead to unsafe invocation and misuse because operators may not realize the skill can be used as a generic data collection and file-writing utility.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The template imports executable JavaScript from a third-party CDN, which creates a supply-chain and integrity risk: anyone controlling or tampering with that dependency or the network path can execute arbitrary script in the page context. Because this is a local HTML template intended for rendering and clipboard export, the external dependency is not strictly necessary and increases exposure beyond the template's core purpose.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The README advertises activation via broad natural-language phrases like '帮我分析一下…' and similar everyday wording, which can cause the skill to trigger unintentionally when a user is discussing companies rather than explicitly requesting this tool. In an agent environment, overly broad invocation patterns increase the chance of surprise execution, unintended outbound requests, and generation of local artifacts without clear user intent.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The phrase '自然说就行' together with the routing table implies fuzzy activation boundaries, especially for partial workflows like financial-only or profile-only modes. This makes it easier for ordinary conversation to be interpreted as an execution request, leading to unintended data collection, web lookups, and report generation.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README lists multiple third-party data sources and WebSearch usage, but does not prominently warn users that their company queries and related lookups will be sent to external services. Even if the data seems non-sensitive, user research interests, watchlists, or internal target companies can be confidential and may be disclosed through these outbound requests.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The README states that collected data is written to system temporary directories, but does not prominently warn users about local persistence of fetched data and generated outputs. Temporary directories are often shared across processes or users depending on environment, and persisted files can expose research activity or cached financial data beyond the immediate session.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger phrases are broad and overlap with ordinary investment discussion terms, increasing the chance the skill runs when a user did not intend to invoke it. Because the skill performs network collection, shell-based script execution, and file creation by default, accidental activation meaningfully increases exposure and can surprise users with external requests and disk artifacts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill states that it will generate report artifacts and later writes temporary JSON files, but it does not clearly warn users up front that files will be created on disk by default. Unexpected local file creation can leak sensitive inputs such as queried tickers, analysis contents, or derived datasets to other processes or later sessions, especially when using shared or persistent environments.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill instructs direct collection from multiple external finance endpoints without a clear disclosure that user-supplied company names/codes and request metadata will be sent to third-party services. In privacy-sensitive or enterprise settings, silent outbound requests can reveal research interests, trading intent, or internal watchlists to external providers.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The file explicitly instructs the skill to perform external network lookups (including WebSearch-based peer retrieval and searching annual reports) without disclosing that user inputs or derived company targets may be sent to third-party services. While this is expected in an investment-research workflow, the lack of transparency and consent creates a privacy and data-governance issue, especially in enterprise environments where queries may be sensitive.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The template explicitly instructs consumers to read financial data from predictable local temporary files under /tmp and to use direct CLI-based collection for comparable-company financials. Even though this is a template, exposing internal file paths and acquisition mechanisms can encourage unsafe handling of cached data, accidental cross-run data reuse, and disclosure of internal implementation details to downstream users or agents.

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The dependency specification allows installation of requests 2.28.0 and later versions within the same major line, and 2.28.0 is affected by multiple published advisories including credential leakage and TLS verification issues. In a skill that explicitly performs network fetching of market data, news, reports, and announcements, a vulnerable HTTP client increases the risk of SSRF-adjacent abuse, credential disclosure via malicious URLs, or weakened transport security when processing untrusted remote resources.

Known Vulnerable Dependency: lxml==4.9.0 — 4 advisory(ies): CVE-2026-41066 (lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to); CVE-2022-2309 (lxml NULL Pointer Dereference allows attackers to cause a denial of service); CVE-2022-2309 (NULL Pointer Dereference allows attackers to cause a denial of service (or appli) +1 more

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: The dependency specification permits lxml 4.9.0, which is associated with multiple advisories including XXE-related parser risk and denial-of-service conditions. Because this skill ingests externally sourced HTML and financial content, vulnerable XML/HTML parsing can become materially dangerous if attacker-controlled or malformed content is processed, potentially enabling file disclosure, network access via entity expansion, or parser crashes.

Static analysis

No suspicious patterns detected.