Security audit

quant-buddy-skill

Security checks for vulnerabilities and agentic risk

Overview

This finance skill appears legitimate, but it handles credentials, user queries, local uploads, logs, and skill updates in ways users should review carefully before installing.

Review before installing. Prefer manual local credential setup instead of pasting API keys into chat, treat config.json, config.local.json, logs/, and output/ as sensitive, and do not upload confidential or licensed CSV data unless you intend to send it to QuantBuddy. Avoid using the zip update flow unless you fully trust and verify the archive contents.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (37)

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: Embedding self-update and deployment instructions inside an otherwise data-query skill broadens the skill's operational scope to software installation and file replacement. If those instructions are ever followed automatically or semi-automatically, a user asking to 'update the skill' could trigger filesystem changes, code replacement, and persistence of new behavior unrelated to the quant-data function.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: These instructions explicitly authorize copying directories, unzipping archives, overwriting skill files, and preserving credentials during redeployment. For a stock-data assistant, that is excessive authority: a malicious or trojanized zip could replace code, add new exfiltration logic, or persist modified behavior while retaining existing API keys in config.json.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The recipe expands the skill from structured market/financial data retrieval into open-ended external news search and subjective earnings-surprise labeling. That creates a scope mismatch: the agent may rely on unverified external sources, perform inconsistent judgment calls, and present results as if they were backed by the platform’s quantitative APIs, which can mislead users and weaken trust boundaries around tool use.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The documentation explicitly tells users to send their API key to the AI assistant so it can write the credential into config.json. This creates a direct natural-language secret disclosure channel, expands credential exposure beyond the local system, and normalizes unsafe handling of sensitive tokens. In this skill context, the risk is heightened because the assistant is being encouraged to collect a live platform API key for a finance-related service, which could be misused for unauthorized API access or stored in logs/transcripts.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The audit document describes an optional Bocha web-search integration that extends the skill beyond its stated stock and financial data scope. Even if opt-in, this adds a second external data sink and capability surface that may process user prompts or derived context in ways not reflected in the manifest, increasing data-flow and supply-chain risk.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The summary claims the skill does not read OS credentials or environment variables beyond BOCHA_API_KEY, but earlier text says it also reads QUANT_BUDDY_API_KEY. This inconsistency undermines the trustworthiness of the audit and can cause reviewers to miss actual secret-handling behavior, which is a documentation security issue even if not an exploit by itself.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The wrapper exposes webSearch and buildEventStudy local capabilities that are not disclosed in the skill description, expanding the effective privilege and data-access surface beyond user expectations. Hidden capability expansion is dangerous because users and reviewers may authorize a stock-data skill while unknowingly granting broader web retrieval and analysis behavior.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: newSession silently transmits the user's original query and authorization header to a remote endpoint for trace/telemetry purposes, but this behavior is not disclosed in the skill description. Undisclosed network reporting of user prompts can leak sensitive financial intent, research topics, or proprietary queries and violates least surprise.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: This module extends a stock-analysis skill with a generic external web-search capability and credential loading path that are not clearly justified by the stated skill scope. That creates an unnecessary data egress surface: user prompts or internally derived queries can be sent to a third-party service, and the skill gains access to an additional secret, increasing privacy and supply-chain risk even if the implementation is not overtly malicious.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The code reads an external API key from environment variables or local config files even though the skill description centers on stock analytics, not third-party web search. Secret access beyond the documented capability set is risky because it broadens what the skill can do and makes accidental or unauthorized outbound use of those credentials possible.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The executor persistently writes logs to disk and supports file upload/preview flows, which goes beyond a purely transient stock-query interface described in the skill metadata. While these capabilities are not inherently malicious, they create local data handling and retention risks because file paths, uploaded content metadata, and operational traces are stored without an explicit user-consent boundary.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The tool is documented as retrieving complete formula groups from an internal card database by card ID, which is outside the manifest's stated scope of stock quotes, financial metrics, screening, and backtesting. This creates a scope-expansion and internal capability exposure risk: an agent intended for market-data tasks can access reusable internal strategy templates or proprietary content not clearly intended for end users.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The tool exposes database-backed retrieval of full card/formula templates via MongoDB-style object IDs, indicating access to internal platform artifacts rather than ordinary market-data queries. If an agent can enumerate or reuse these IDs, it may disclose proprietary strategies, internal prompt assets, or sensitive business logic beyond the user-facing financial analytics purpose.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The file instructs the tool to automatically persist results to local files and to depend on session/cache state as part of normal execution. In an agent environment, implicit filesystem writes and session-file coupling create unintended statefulness, can leak prior-run data across tasks, and may expose local path or user-derived content without explicit consent.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The workflow contains contradictory rules for interpreting percentage thresholds: one section says platform return data uses decimal form such as 0.05 for 5%, while another later section says natural-language percentages should default to display-form values such as 3 or 10 unless data docs explicitly say decimals. In a trading or screening skill, this inconsistency can silently invert or nullify filters, producing incorrect stock selections, rankings, or alerts while appearing to follow policy.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The workflow contains mutually exclusive instructions for how to retrieve the trailing N rows: the primary protocol requires `readData(mode="last_n_rows", last_n_rows=N)`, while later sections state one-dimensional series do not support `last_n_rows` and require `last_column_full`. An agent following the wrong branch can fail, over-fetch historical data, or produce answers from an unintended window, which is especially risky for a finance skill expected to return bounded recent market data.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: Later failure-recovery rules instruct the agent that fallback to `readData` must use `last_n_rows`, directly conflicting with earlier hard rules that only `last_column_full` works for one-dimensional time series. This inconsistency can cause repeated failures, unsafe retries, or large unintended data pulls, undermining reliability and potentially causing the model to answer with incomplete or stale data.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The document maps natural-language windows such as 6 months to 120 trading days, but elsewhere says any `N > 60` must safety-fail. This creates an internal policy conflict where a normal user request can be both allowed and forbidden, leading to inconsistent handling, denial of legitimate requests, or ad hoc workarounds by the agent.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: One section requires `begin_date` to go back 4 to 8 months to ensure coverage, while another later rule says `begin_date` may be at most `N×2` natural days back. These constraints cannot both be true for many values of N, so the agent may either under-fetch and return incomplete windows or over-fetch and exceed context/token budgets.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The file instructs the agent to read the entire card index and select cards by loose tag matching, but it does not define hard trigger boundaries, disambiguation rules, or exclusion cases. In a broad finance skill with many overlapping tags, this can cause over-triggering and invocation of overly powerful analysis/backtest workflows for simple queries, increasing the chance of irrelevant tool use, unintended data processing, and prompt-routing abuse from crafted user inputs.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The recipe instructs the agent/user to upload a local CSV file from a desktop path to the platform, but it gives no warning that the file contents will be transmitted off-device and stored/processed remotely. In a finance workflow, uploaded factor files may contain proprietary research, licensed data, or sensitive identifiers, so omission of a privacy/data-handling notice can lead to unintended disclosure.

Natural-Language Policy Violations

High

Confidence: 99% confidence
Finding: The Chinese guidance directs the user to disclose an sk-prefixed API key in conversation without presenting a safer alternative in that same flow or warning about privacy and logging risks. That is an unsafe social-engineering-like instruction pattern because users may assume the assistant is an appropriate secret recipient, causing credential compromise through transcripts, telemetry, or downstream tool access. The finance/data-query context makes this more dangerous because the skill is positioned as the preferred route for real data access, increasing the likelihood users will comply.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The helper automatically writes decoded chart content to disk and opens the file on Windows without an explicit warning or consent at execution time. In a skill context, unexpected file writes and auto-opening local content increase risk of privacy leaks, unsafe user surprise, and exposure to malformed content handling in external viewers.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Session initialization performs a network request that includes user_query and bearer authorization data without a visible runtime warning. In this skill's finance-oriented context, user queries may contain sensitive trading interests or proprietary research, making silent transmission materially more dangerous.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The function sends caller-provided search queries directly to a third-party web API without any disclosure, consent, minimization, or redaction controls visible in this file. If users include sensitive strategy terms, company names, unpublished research topics, or identifiers in queries, those are transmitted off-platform and may be logged by the provider.

Static analysis

No suspicious patterns detected.