Stock Monitor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:24 AM UTC
• Version: 1.3.0

Overview

The main stock alert tool is mostly coherent, but the package also includes undocumented Futu and rebalancing scripts, including use of a configured unlock password, which needs review before installation.

Review the bundled scripts before installing. Use the Yahoo monitor only if you are comfortable with periodic stock lookups and local state files. Do not place Futu unlock credentials in the config unless you understand exactly what that unlock enables and why this skill needs it. Treat the rebalance script as an additional financial reminder workflow that is not described in the main skill documentation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This finding indicates the implementation behaves more like a rule engine for trading or rebalancing triggers, with composite conditions, cooldowns, and persistent rule state, rather than a simple percentage-move monitor. That expanded functionality materially changes risk because users may unknowingly deploy more powerful automation than advertised, potentially affecting decisions, workflow integration, or downstream automated actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This finding indicates the implementation behaves more like a rule engine for trading or rebalancing triggers, with composite conditions, cooldowns, and persistent rule state, rather than a simple percentage-move monitor. That expanded functionality materially changes risk because users may unknowingly deploy more powerful automation than advertised, potentially affecting decisions, workflow integration, or downstream automated actions.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/stocks_rebalance_monitor.py (reported line 181)May include surrounding context.

python

rule_message += f"\n\n触发时间：{now.strftime('%Y-%m-%d %H:%M')}"
            
            save_state(state)
            return rule_message
        else:
            return None
    else:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill documents execution of a Python script that reads configuration, writes persistent state, and fetches market data, but it does not declare any explicit tool scope or permissions. In an agent environment, missing capability declarations weakens least-privilege controls and can cause users or orchestration layers to approve a skill without understanding that it can access files and the network.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

All user-facing natural-language content in the skill description is Chinese, with no indication that other languages are supported or that the locale is intentionally restricted. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest says the skill uses Yahoo Finance API to fetch real-time stock prices, but the file docstring and imports show it is built around the Futu OpenD API (from futu import *). This is a direct description-to-behavior mismatch about the core external dependency and operating model of the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Natural-language strings in the module docstring and runtime output are presented only in Chinese, with no opt-in or language selection mechanism. This creates a language policy issue because the skill effectively requires a specific language for understanding usage and results.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

A read-only stock monitoring script should not need to unlock market/trading functionality, yet this code conditionally uses a configured unlock password to change the state of the Futu OpenD session. Enabling broader account capabilities than necessary violates least privilege and increases the blast radius if the script, host, or dependent library is misused or later extended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script reads an unlock password from configuration and uses it silently, without prompting, warning, or explaining why a monitoring tool needs sensitive trading-related credentials. Storing and consuming such secrets in a generic config file raises the risk of credential exposure through filesystem access, backups, logs, or accidental reuse by other tools.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains natural-language strings in Chinese for the module docstring and user guidance, and the rest of the script also prints only Chinese messages. Under the policy rule, forcing a specific language without user opt-in is a locale-policy violation unless the restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a skill for real-time stock price monitoring with per-stock rise/fall threshold alerts, but this file is explicitly a '股票调仓监控脚本' and processes 'rebalance_rules' made of multi-condition rule logic. The code's primary behavior is evaluating composite rebalancing conditions and repeated rebalance reminders, which is a narrower and materially different workflow than the manifest's stated stock alert functionality.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains user-facing natural-language documentation entirely in Chinese, including the title and usage instructions. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill notes a state file location, but the description does not prominently warn that monitoring state is persisted in user storage. While not severe by itself, undisclosed persistence can surprise users, create stale-state issues, and expose potentially sensitive watchlists or alert history on shared systems.

Content

No source excerpt is available for this finding.