Security audit

A 股大师 Pro

Security checks for vulnerabilities and agentic risk

Overview

This stock-monitoring skill is mostly purpose-aligned, but it needs Review because it includes unsafe credential handling and under-scoped persistence around sensitive portfolio data.

Review before installing. Do not use the bundled QVeris key; require a fixed release with that key removed and rotated. Use your own key through a safer secret mechanism, avoid inline cron secrets, inspect or opt into any scheduled jobs, and protect or delete local holdings and alert JSON files when you stop using the skill.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The document embeds a real-looking QVeris API key directly in installation commands and instructs users to export it into their environment. Hardcoded credentials in distributed documentation can be copied by any reader, reused without authorization, and expose the associated account, billing, and data access.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The installation guide tells users that the API key will be configured automatically, while the script explicitly requires a pre-set `QVERIS_API_KEY`. This mismatch can mislead users into trusting an opaque installation flow or running third-party setup commands that modify their environment without informed consent, which is especially risky because the guide pushes an external dependency and referral link.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The installation guide states that Crontab tasks are 'preconfigured' and 'automatically enabled after installation' without a prominent upfront warning or explicit user consent step. Auto-enabling recurring jobs is security-relevant because it creates persistent background execution on the user's system, increases attack surface, and may run networked or data-accessing scripts on a schedule without the user fully realizing it.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The setup section displays and persists a credential-like secret without any caution about sensitivity, which encourages unsafe handling of secrets. Even if intended for convenience, publishing a live-looking key in plaintext materially increases the risk of credential theft, abuse, and accidental propagation into shell history, screenshots, or repositories.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill explicitly promotes 持仓监控 and realtime盈亏/公告 monitoring, which implies handling sensitive portfolio and trading-preference data, but this release summary does not present any explicit privacy notice, consent language, retention policy, or data-handling warning. In a finance-focused skill, omission of clear disclosure increases the risk of users exposing holdings and account-related behavioral data without understanding how it is processed or shared with dependencies such as QVeris.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The setup guide instructs users to print the API key with `echo $QVERIS_API_KEY`, which can disclose credentials to shoulder-surfing, terminal logging, shell history capture, screen sharing, or support screenshots. While this is framed as verification, exposing secrets in plaintext is unnecessary and increases the chance of accidental leakage.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The cron examples embed the API key directly in crontab commands, which can expose the secret through shell history, backups, process listings in some environments, admin inspection of crontab contents, and copied configuration files. Because cron entries are persistent, the credential remains stored in plaintext long-term, increasing the blast radius of compromise.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger examples are broad everyday phrases, which can cause the skill to activate unintentionally during normal financial conversation. Unintended activation matters here because the skill can access external tooling and may read or persist sensitive portfolio information without a sufficiently deliberate user action.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The read_when rules are vague and expansive, with no clear boundaries for when the skill should not load. In practice this increases the chance of the skill being selected in ambiguous contexts and exposing user financial context to local persistence or external services when the user did not clearly request it.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs the system to create and maintain a local holdings.json containing portfolio details, but this storage behavior is not prominently disclosed up front. Portfolio positions, cost basis, and notes are sensitive financial data, and silent persistence increases privacy risk on shared or compromised systems.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill description omits that portfolio and watchlist information may be transmitted to the external QVeris service for analysis. Because this is sensitive financial information, failing to warn users about third-party transmission undermines informed consent and can lead to confidentiality and compliance issues.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The guide instructs users to place the QVERIS API key directly into crontab entries as an inline environment variable (`export QVERIS_API_KEY="sk-xxx"`). In practice, users may replace the placeholder with a real secret, causing credentials to be stored in plaintext in shell history, crontab backups, screenshots, shared docs, or local account configuration without any warning about secret handling.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The phrase “打开盯盘界面” is a broad natural-language trigger without defined scope, confirmation, or exclusion rules, so ordinary conversation can unintentionally activate the skill. In this skill’s context, accidental triggering can expose local file/localhost dashboard links and initiate finance-related monitoring workflows the user did not explicitly request.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script persists detailed portfolio check results and alert history to local JSON files, including holdings-derived trading information, profit/loss, and triggered alerts, with no consent flow, retention notice, access control, or masking. In an agent skill context, these files may be readable by other local processes, users, backups, or later skill runs, creating a privacy and financial confidentiality risk even if no remote exfiltration is present.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script reads portfolio holdings from a local file and transmits stock codes to an external QVeris CLI/API to fetch market data, but there is no user consent flow, privacy notice, or data-minimization control around that disclosure. Even though only codes are sent here, holdings metadata is sensitive financial information and the skill context makes this more concerning because it is explicitly a portfolio-monitoring tool handling a user's investment positions.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/aggregate_data.mjs:33

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/announcement_monitor.mjs:32

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/check_holdings.mjs:37

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/dragon_tiger.mjs:32

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/earnings_calendar.mjs:32

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/market_review.mjs:34

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/stock_screener.mjs:28

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: INSTALL_SUMMARY.md:50