Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
A股-股市分析和投资顾问（安西军项目）
Security checks for vulnerabilities and agentic risk
Overview
This stock-analysis skill is mostly a read-only market-data helper, but it adds web/forum search, sub-agent workflow, and unspecified notification pushing beyond its stated /stocks-only boundary.
Review this skill before installing. It should be limited to public stock-data analysis, and you should only provide TAX_API_KEY through the platform environment setting. Do not paste the key into chat. Treat any notification-push behavior as unapproved unless you know where it sends data and have explicitly requested it; also be aware that web/news/forum searches may reveal the stocks or topics you ask about to external search providers.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest and requirements present the skill as limited to read-only /stocks queries, but the workflow expands into website/news/forum search and notification pushing. This mismatch weakens trust boundaries and can cause the agent to access external sources or transmit data in ways not disclosed by the primary capability description.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The workflow includes notification pushing but does not say what information may be sent, to which destination, or under what authorization. Even in a read-only stock-analysis skill, outbound notifications can expose user queries, derived analysis, or identifiers to unintended recipients if not tightly scoped and disclosed.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document explicitly says the skill must only call /stocks/... routes, yet later instructs use of general web search and notification push. Conflicting instructions create policy ambiguity that an agent may resolve unsafely, enabling unreviewed external requests or outbound data sharing beyond the stated route restrictions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill directs collection of news, websites, and forum content via search without warning users that their stock interests or prompts may be sent to external providers. This expands data exposure and introduces untrusted content into the analysis pipeline, increasing privacy and prompt-injection risk despite the skill's ostensibly read-only financial-query purpose.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list includes broad, generic finance terms such as '指数', '行情', '公告', and '政策法规', which can cause this skill to activate for loosely related requests beyond intended A-share/HK-stock analysis use cases. Overbroad routing can misdirect user queries, expose the skill to irrelevant contexts, and increase the chance that sensitive or higher-priority tasks are handled by the wrong skill, degrading security boundaries and correctness.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents operational skill documentation entirely in Chinese, including lines describing skill scope and behavior, with no indication that the language is optional or region-specific by design. Under the policy, forcing a specific language without opt-in is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The natural-language instructions and user-facing guidance are entirely in Chinese, and the file does not indicate that the user may choose another language or that the locale restriction is required for compliance or region-specific operation. Under the stated policy, forcing a specific language without opt-in can be a language/locale policy issue.
- Content
Static analysis
No suspicious patterns detected.