china-fund-strategy

• Outcome: Review
• Latest audit: Aug 17, 2026 · 6:13 PM UTC
• Version: 0.1.1

Overview

The skill is mostly coherent, but it generates highly specific trading instructions while disclaiming investment advice and gives scripts broad, weakly bounded file-write scope.

Install only if you are comfortable with a tool that fetches fund data online, reads local CSVs, writes persistent analysis files, and produces prescriptive trading strategies. Treat its output as informational analysis, not professional or personalized financial advice, and keep FUND_ANALYSIS_BASE_PATH limited to a dedicated analysis folder.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tainted flow: 'output_file' from os.environ.get (line 134, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

# Default to ./investment_analysis/<fund_code>_analysis.md but allow override via env var
    base_path = os.environ.get('FUND_ANALYSIS_BASE_PATH', 'investment_analysis')
    output_file = Path('.') / base_path / f"{fund_code}_analysis.md"
    with open(output_file, 'w', encoding='utf-8') as f:
        f.write(report)

    print(f"报告已保存至: {output_file}")

• Confidence: 90% confidence
• Finding: The script allows an environment variable to control the base output directory and then writes a file there without constraining or validating the path. In an agent or automation context, an attacker who can influence the environment can redirect output to unintended filesystem locations, causing arbitrary file overwrite within the executing user's permissions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill describes capabilities to read environment variables and read/write files, but it does not declare any permissions or boundaries for those operations. That creates a real security issue because an agent or reviewer cannot easily determine what filesystem scope is intended, increasing the risk of over-broad access, unsafe path handling, or unintended exposure of local data if the backing scripts are executed.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The report claims it is not investment advice, yet throughout the document it gives concrete buy/sell timing, position sizing, stop-loss levels, target returns, and investor-profile-specific strategies. This mismatch can mislead users and downstream agents into treating regulated financial advice as safely disclaimed commentary, increasing legal, compliance, and user-harm risk.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The document combines a disclaimer that it is 'not investment advice' with extensive concrete trading guidance elsewhere in the report, including buy/sell timing, stop-loss rules, expected returns, position sizing, and investor-profile-specific strategies. In the context of an investment-analysis skill, this contradiction can mislead users into treating the output as actionable financial advice while attempting to evade responsibility, creating consumer protection, compliance, and harm risks.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: The output location is made configurable via an environment variable even though that flexibility is not necessary for the stated analysis purpose, which expands the attack surface. In agent environments where environment variables may be inherited or attacker-influenced, this can be used to steer writes into sensitive or unexpected locations.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The code produces concrete buy/sell timing, position sizing, stop-loss, and expected return guidance directly in the generated report, while only placing a generic disclaimer at the very end. In a skill explicitly designed to generate investment strategy reports, this increases the chance users will rely on automated financial advice without timely warnings, suitability checks, or validation, creating real-world harm and compliance risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.