Security audit

全球股市资讯

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed market-news report generator that searches public financial news and saves a dated Markdown report, with no evidence of hidden execution, credential access, or destructive behavior.

Install only if you want a skill that performs current public market research and writes a daily Markdown report to your Documents folder. Treat the output as market commentary, not financial advice, and review the saved path if you prefer reports to stay inside a project workspace.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger conditions are overly broad, allowing the skill to activate for generic requests like market analysis or global market summaries without clear user intent boundaries. This can cause unintended invocation of the skill's downstream behaviors, including web research and file creation, when a user may have only wanted a conversational answer.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: The skill instructs automatic creation of directories and saving a report to a fixed local filesystem path without any user-facing notice or confirmation. Unprompted local writes are dangerous because they create persistent side effects, may overwrite user expectations about workspace boundaries, and can be abused if the skill is invoked unintentionally.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.