Back to skill

Security audit

股海罗盘 - A股股票量化分析

Security checks across malware telemetry and agentic risk

Overview

This stock-analysis skill is mostly coherent, but it handles API keys and database credentials in ways that need careful review before installation.

Install only if you are comfortable with a finance-analysis skill that writes a local API key, sends that key to its payment/API services, and may print it in logs. Avoid shared terminals, CI logs, or regulated environments until the publisher removes full-key URLs/logging and hardcoded database credentials.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (25)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill documents code paths that read and write local files, access environment/configuration, and make network requests, but it declares no corresponding permissions. This creates a transparency and trust problem: a host may invoke the skill assuming it is low-risk while it can still touch sensitive local state and external services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The declared purpose is stock analysis, but the documented behavior also includes local API key generation/storage, payment-link construction carrying the key, paywall/upsell logic, and direct database connectivity with hardcoded credentials. These extra behaviors materially expand the attack surface and can expose secrets or sensitive local state in ways a user would not expect from a data-analysis skill.

Description-Behavior Mismatch

High
Confidence
89% confidence
Finding
The skill claims it only provides data/statistics, but its workflow and templates instruct generation of scoring, directional judgments, and market-selection conclusions. This mismatch can mislead integrators about what the skill actually does and can bypass policy or oversight controls that would apply to advisory-style outputs.

Intent-Code Divergence

High
Confidence
90% confidence
Finding
The documentation states the skill does not generate conclusions, yet elsewhere it requires conclusion-generation, prediction-like wording substitutions, and user-facing decision-oriented summaries. Contradictory instructions increase the chance that reviewers and calling systems underestimate the skill's real behavior and associated compliance or safety risks.

Intent-Code Divergence

High
Confidence
90% confidence
Finding
The risk/disclaimer section says the tool itself does not generate analysis conclusions, but the mandatory report templates direct concrete conclusion and scoring output. This can be used to create a false sense that responsibility is externalized while the skill itself operationally steers user interpretation.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code constructs an outbound payment URL containing config.API_KEY as a query parameter, which exposes a sensitive credential to the user, browser history, logs, referrers, proxies, and the remote service. The nearby comments explicitly state this is done so the server can identify who paid, confirming intentional secret exfiltration outside the analysis function's stated purpose.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The comments describe intentionally sending the local API key in a payment link so the server can determine who paid, indicating conscious design of credential disclosure rather than an accidental coding mistake. In a data-analysis skill, this is especially risky because users would not expect a secret-bearing monetization link to be generated as part of analysis output.

Context-Inappropriate Capability

Medium
Confidence
99% confidence
Finding
The module prints a full purchase URL containing the raw API key to stdout, which can leak credentials into terminal history, application logs, CI logs, telemetry, or chat transcripts. This is unnecessary for core stock-analysis functionality and turns a secret into a broadly exposed bearer token or account identifier.

Intent-Code Divergence

Medium
Confidence
99% confidence
Finding
The comments explicitly acknowledge the sensitivity of the full API key, yet the code immediately logs a URL containing that same unmasked key. This contradiction increases the likelihood of accidental credential disclosure because developers may believe masking is being respected while the secret is still emitted in logs.

Intent-Code Divergence

Medium
Confidence
84% confidence
Finding
The comment states data is pulled from the database, but the implementation actually performs an external Tencent API fetch when klines is omitted. This hidden network dependency can violate operator expectations, create unreviewed data egress paths, and undermine security assumptions in environments that expect offline or database-only processing.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The report generator contains embedded upsell/paid-conversion logic that is unrelated to core stock analysis and silently alters output behavior when data is unavailable. This is dangerous because it mixes business/marketing behavior into a data-processing skill, creating an undisclosed secondary function and increasing the chance of user deception or unauthorized external navigation.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code appends the local API key to an external purchase URL as a query parameter, which can leak secrets to third parties via browser history, logs, referrers, proxies, or analytics systems. In a stock-reporting skill, exporting a local credential to an unrelated external site is highly disproportionate and can enable account linkage, impersonation, or unauthorized activation flows.

Intent-Code Divergence

Medium
Confidence
84% confidence
Finding
The module docstring states that missing external data triggers a lightweight fallback, but the actual downgrade path injects paid placeholder and marketing chapters instead. This mismatch is dangerous because it obscures real behavior from reviewers and users, making it easier to hide non-core functionality and undermining informed consent and trust in the skill's execution path.

Context-Inappropriate Capability

High
Confidence
100% confidence
Finding
The file embeds plaintext database connection strings, including usernames, passwords, internal server IPs, and a production fallback path. Anyone with access to the code can reuse these secrets to connect directly to the databases, exposing sensitive market/research data and potentially enabling broader lateral movement in the internal network.

Vague Triggers

Medium
Confidence
83% confidence
Finding
Broad trigger phrases can cause the skill to activate on vague requests, leading to unintended network calls, report generation, or paid API consumption. In a skill that touches local files and external services, over-broad invocation increases the chance of surprising side effects and unwanted data handling.

Vague Triggers

Medium
Confidence
82% confidence
Finding
Using vague everyday phrases as default triggers increases accidental invocation risk, especially because the skill can perform network requests, access local files, and invoke monetization logic. Unintended execution can consume quotas, leak context into external services, or create local artifacts without clear user intent.

Missing User Warnings

High
Confidence
99% confidence
Finding
The function returns a payment URL with the API key embedded and does so unconditionally, without disclosure or consent, making sensitive data leakage likely whenever the result is displayed, logged, or followed. Query-string secrets are broadly exposed across systems and can enable unauthorized use of the key or lateral access depending on what the key protects.

Missing User Warnings

High
Confidence
100% confidence
Finding
Printing the full API key in a user-visible URL is a direct secret exposure. Anyone with access to console output or captured logs can reuse the key for unauthorized API access, account linkage, or abuse of any downstream functionality tied to that key.

Missing User Warnings

High
Confidence
99% confidence
Finding
The code embeds config.API_KEY directly into a URL query string for a payment link. Query parameters are commonly exposed through browser history, logs, analytics, referrer headers, screenshots, and copy/paste sharing, which can leak the credential and allow unauthorized use of the API key.

Missing User Warnings

Low
Confidence
78% confidence
Finding
This code path reaches out to an external market-data service without any user-facing disclosure or consent mechanism. In security-sensitive or regulated deployments, undisclosed outbound connections can leak usage metadata, break network isolation expectations, and complicate compliance review.

Missing User Warnings

High
Confidence
99% confidence
Finding
Embedded database credentials are directly exposed in source code with no disclosure, access mediation, or runtime secret retrieval. This creates immediate secret leakage risk and unauthorized database access for anyone who can read the repository, package, logs, or deployed artifact.

Ssd 3

High
Confidence
98% confidence
Finding
The instructions explicitly require exposing the full local API key in a user-facing purchase link. That is a direct secret-disclosure risk: the key may be revealed in chat transcripts, logs, screenshots, browser history, referrers, or third-party analytics, enabling account takeover, fraudulent activation, or quota abuse.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
python-docx>=1.0.0
matplotlib>=3.6.0
mplfinance>=0.12.10
Confidence
95% confidence
Finding
python-docx>=1.0.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
python-docx>=1.0.0
matplotlib>=3.6.0
mplfinance>=0.12.10
Confidence
95% confidence
Finding
matplotlib>=3.6.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
python-docx>=1.0.0
matplotlib>=3.6.0
mplfinance>=0.12.10
Confidence
95% confidence
Finding
mplfinance>=0.12.10

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.