FinXData

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:27 AM UTC
• Version: 1.0.16

Overview

This skill is a disclosed FinXData financial-data connector with bounded HTTPS API access, optional API-key use, and no hidden persistence or destructive behavior.

Install this if you are comfortable sending financial query parameters, an agent-type identifier, and optionally your FinXData API key to FinXData over HTTPS. Review the implicit-invocation setting and the Chinese-first documentation if language behavior or automatic activation matters in your environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documents shell execution, environment-variable access, and outbound network use, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization gap: a host agent may expose broader capabilities than intended, and reviewers or policy engines cannot reliably constrain execution to the minimum required privileges.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The manifest description and the entire markdown guidance are written as instructions that assume Chinese-language interaction, and there is no opt-in, language selection, or justification that this skill is intentionally limited to Chinese-speaking users or a China-only compliance context. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The natural-language strings at these lines instruct the skill to describe and explain results in Chinese-oriented wording, including '用易懂语言解释结果', with no option for the user's preferred language or locale. This can violate language/locale policy when the skill is used in contexts where users have not opted into Chinese output.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill enables implicit invocation without any trigger constraints, so the platform may auto-activate it based on broad relevance rather than explicit user intent. In a financial-data skill, this can cause unrequested tool use, unnecessary external data access, and responses that steer users into a specific provider flow without clear consent.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code file contains multiple user-facing messages in Chinese, including authentication, rate-limit, service, and timeout/network errors, while other strings such as CLI descriptions are in English. That imposes a specific language on users without opt-in or an explicit region-specific justification, which matches the language/locale policy violation criteria.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: 该参考文档从标题到全部操作说明均以中文编写，没有给出可选语言、用户可切换语言的说明，属于自然语言层面的语言/地区策略约束。根据规则，若技能强制特定语言且无用户 opt-in，应视为政策问题。

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: This code sends an authenticated HTTPS request to /api/quota/api-key, which necessarily transmits the API key in an HTTP header. While the overall client purpose is API access, this specific operation has no nearby confirmation, log, or comment disclosing that credential-backed network transmission occurs.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

def command_data(args: argparse.Namespace) -> None:
    spec = ENDPOINTS[(args.group, args.action)]
    params = {
        name: getattr(args, name) for name, _required, _default in spec["parameters"]
    }
    is_agent = (args.group, args.action) in AGENT_ENDPOINTS
    agent_type = None

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Static analysis

No suspicious patterns detected.