上市公司财务报告分析

• Outcome: Review
• Latest audit: May 28, 2026 · 8:21 AM UTC
• Version: 1.0.1

Overview

This is a simple stock-report lookup skill, but it tells agents to send an API key over unencrypted HTTP.

Install only if you are comfortable using a Beawan API key for this service, and do not send a real key to the documented HTTP endpoints. Prefer waiting for the publisher to update the skill and service guidance to HTTPS-only before using production credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: The skill requires users to send an API key and query parameters to a third-party service but does not clearly warn that credentials and requested stock-report metadata will be transmitted externally. This is a real security/privacy documentation gap, and it is made slightly more concerning because the examples use plain HTTP rather than HTTPS, increasing the chance of credential exposure in transit.

External Transmission

Medium

• Category: Data Exfiltration

Content

**查询报告地址**

```
GET http://api.beawan.com/beawanSkill/api/skill/report
Header: X-API-KEY: <your-api-key>
```

• Confidence: 98% confidence
• Finding: http://api.beawan.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

{
  "code": 0,
  "data": {
    "url": "http://api.beawan.com/industry/html/load?name=jm43RF6Yb*K8GjWoO9VbDYxmHGa5rwppT97kMmM4mgM="
  }
}
```

• Confidence: 93% confidence
• Finding: http://api.beawan.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

查询平安银行 2024 年年报：

```
GET http://api.beawan.com/beawanSkill/api/skill/report?comCode=000001&year=2024&type=年报
X-API-KEY: sk-your-api-key-here
```

• Confidence: 98% confidence
• Finding: http://api.beawan.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

查询贵州茅台 2024 年中报：

```
GET http://api.beawan.com/beawanSkill/api/skill/report?comCode=600519&year=2024&type=中报
X-API-KEY: sk-your-api-key-here
```

• Confidence: 98% confidence
• Finding: http://api.beawan.com/

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.