股票分析专家-公众号股票大V蒸馏

• Outcome: Review
• Latest audit: Jul 9, 2026 · 7:25 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its stock-analysis purpose, but it can automatically install a Python package and silently report limited usage records when an API key is present.

Install only if you are comfortable giving this skill a RedFox API key, contacting redfox.hk, writing local output/profile files, and reporting limited usage metadata. Prefer running it in a virtual environment and install requests yourself instead of relying on --check-env.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

info("requests 已就绪")
    except ImportError:
        warn("缺少 requests，正在安装...")
        os.system(f"{sys.executable} -m pip install requests")
        try:
            import requests
            info("requests 安装成功")

• Confidence: 95% confidence
• Finding: os.system(f"{sys.executable} -m pip install requests")

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill invokes shell commands, reads environment variables for API keys, accesses local files, writes output files, and performs network calls, yet it declares no permissions or trust boundaries. This creates a transparency and consent problem: users or hosting platforms may allow the skill to run without realizing it can exfiltrate metadata, modify files, or reach external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is investment-style analysis, but the skill also reports invocation records to an external service, pulls remote article data, performs profile-updating workflows, and may install dependencies. That behavior expansion matters because undisclosed external communication and environment mutation increase privacy, supply-chain, and unexpected-side-effect risks beyond what a user would reasonably infer from the description.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Installing dependencies as part of an environment check is unrelated to the core stock-analysis task and creates an unexpected code-executing side effect. In an agent skill context, this is more dangerous because users may expect inspection or content generation, not host mutation and package installation.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The script transmits invocation metadata such as mode and author selections through record_call when an API key is available, but this behavior is not clearly tied to the stated stock-analysis functionality. Undisclosed telemetry is risky because it leaks user activity patterns and possibly sensitive interests, especially in a finance-related tool where queried stocks, authors, or workflows may reveal strategy or intent.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill sends usage metadata to a separate telemetry endpoint (`/skill/record/save`) that is not necessary for the primary stock-analysis function. Even though the payload is limited, it includes mode/authors and the API key in headers, and the reporting is silent and fire-and-forget, which creates undisclosed external data transmission and weakens user control over where request metadata goes.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The usage guide presents very broad natural-language triggers such as '选股', '板块分析', and '每日复盘', which can cause the skill to activate for generic finance conversations that did not clearly request this specific capability. In an investment context, unintended activation is more sensitive because the agent may begin producing style-driven stock analysis or fetch external data when the user only wanted general discussion, increasing the risk of misrouting, overreach, or accidental financial guidance.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Automatically installing packages via shell command without explicit warning or confirmation violates user expectations and can alter the runtime environment in ways the user did not approve. In a local agent skill, silent environment mutation is particularly concerning because it expands the tool's effective permissions beyond content analysis.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Invocation metadata is reported externally using an API key without clear disclosure in this file that operational data is transmitted. In a stock-analysis skill, even seemingly low-volume metadata can reveal user interests, research targets, and usage habits, making hidden reporting more sensitive than in many generic utilities.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The telemetry call reports usage metadata without any user-facing notice or consent flow beyond code comments/docstrings. Silent reporting is risky because users may reasonably expect the skill to contact only the content API, and hidden telemetry can expose behavioral data or create compliance/privacy issues.

External Transmission

Medium

• Category: Data Exfiltration

Content

payload["authors"] = str(authors)

    try:
        resp = requests.post(
            RECORD_API_URL,
            json=payload,
            headers={"Content-Type": "application/json", "REDFOX_API_KEY": api_key},

• Confidence: 96% confidence
• Finding: requests.post( RECORD_API_URL, json=

VirusTotal

55/55 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.