Security audit

StockStar Investor - 证券之星投资者互动

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent StockStar investor-relations lookup tool that uses fixed public data sources and does not show hidden persistence, credential access, data exfiltration, or destructive behavior.

Before installing, be aware that broad finance phrasing may trigger public StockStar lookups; use explicit prompts when you want investor Q&A, tags, or signal data. No evidence was found that the skill reads private files, credentials, or changes local/account data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill invokes a Python CLI that accesses external StockStar data, but it does not declare any explicit tool scope or permissions boundary. This weakens least-privilege controls and can allow broader-than-expected network use by the skill runtime, making review and containment harder if the script behavior changes or is abused.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrases are broad enough to match ordinary finance conversation, which can cause the skill to activate when the user did not clearly request this external-data workflow. Over-broad activation increases the chance of unintended tool use, unnecessary network requests, and data being sourced from this skill in contexts where a normal conversational response would have been safer.

Vague Triggers

Medium

Confidence: 98% confidence
Finding: The example trigger '帮我查一下浦发银行' is extremely vague and could match many harmless requests about a company, causing the skill to run without clear user intent. In a skill that performs scripted lookups and network access, vague activation materially raises the risk of unintended execution and confusing or privacy-impacting tool calls.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: This code file contains natural-language documentation that forces a specific language/locale for readers and maintainers. The policy allows locale constraints only when users are given a choice or the constraint is clearly justified, which is not present here.

Natural-Language Policy Violations

Low

Confidence: 91% confidence
Finding: The helper explicitly documents and enforces '固定 UTC+8 北京时间' when formatting dates. This is a natural-language locale policy constraint embedded in code comments and behavior, and the file does not offer users any language/locale or timezone opt-in.

Static analysis

No suspicious patterns detected.