缠论技术分析修改版

• Outcome: Pass
• Latest audit: May 28, 2026, 10:11 AM
• Version:
  1.0.0

Overview

This stock-analysis skill does what it says: fetches market data, analyzes it, and creates local report/chart files.

Install if you are comfortable with the skill contacting public stock-data endpoints and writing Markdown/PNG outputs locally. Use a dedicated output directory for runs, and treat the generated analysis as research rather than investment advice.

Publisher note

need network access to query stock code and fetch k line data

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documentation indicates capabilities to access external market data and generate output files, yet it declares no permissions. This creates a transparency and policy-enforcement gap: a host system or user may approve the skill expecting a passive analysis tool, while it can still perform network access and write artifacts such as PNG, Markdown, and JSON outputs. In this context, the behavior appears aligned with the stated stock-analysis workflow, so the issue is more about undeclared capability exposure than clearly malicious abuse.

VirusTotal

66/66 vendors flagged this skill as clean.