Security audit

Astock Top Gainers

Security checks for vulnerabilities and agentic risk

Overview

The skill has a clear stock-ranking purpose, but it explicitly instructs the agent to bypass browser SSRF navigation controls to reach its data source.

Install only if you are comfortable with a skill that tells the agent to use browser JavaScript evaluation to work around blocked navigation. Prefer a version that uses an approved market-data API or policy-compliant browser access and removes all SSRF-bypass instructions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:36
Finding: Explicit Circumvention of Browser SSRF Security Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Natural-language guidance in the changelog referring to SSRF bypass techniques is highly suspicious because it signals awareness of and possible intent to evade network security controls. Given the skill’s stated purpose, this text has no legitimate operational need and materially increases the likelihood that the implementation contains adversarial request-routing or proxying behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example trigger “最近涨得好的股票” is broad, conversational language that could overlap with ordinary market discussion rather than a clearly scoped skill invocation. The README does not provide explicit trigger boundaries or negative examples to clarify when this skill should activate versus when it should not.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The changelog entry "优化SSRF策略绕过方案" is unrelated to a stock-gainers skill and explicitly references bypassing SSRF protections, which is a strong indicator of hostile or backdoored functionality. In this context, it suggests the skill may contain or be designed to facilitate network-access restriction evasion despite claiming only to query a fixed financial data source.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises broad trigger phrases such as '涨幅最大的股票', '哪些股票涨得最多', and '最近涨得好的股票', which can match ordinary market discussion rather than an explicit request to invoke this exact workflow. Overbroad activation can cause the agent to fetch external data and apply a specific ranking/formatting routine when the user may have intended a general explanation or different analysis, increasing the chance of unintended tool use and data-handling behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The package description and keywords are entirely in Chinese, including specialized A-share market terminology, with no indication that users may interact in other languages or select a locale. This creates a natural-language locale constraint that is undocumented as optional or region-specific in the file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.