A Share Stock Dossier

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:39 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed A-share stock analysis workflow that uses public web research and market-data APIs, with no evidence of hidden persistence, credential access, exfiltration, or destructive behavior.

Before installing, understand that the skill is designed for detailed A-share analysis and may produce trading-style action suggestions. It uses web research plus Eastmoney/Tencent market-data APIs, so requested stock symbols and searches may be sent to external services. Treat outputs as research support, not financial advice, and ask explicitly if you want a different language or shorter format.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The description promises a high-level analytical skill: evidence-first A-share stock and portfolio analysis with deep web verification, transparent retrieval summaries, and broad use cases like logic checks, industry leadership, strategy, and sentiment-plus-technical synthesis. The code chunk, however, is a straightforward data-fetching helper script. It retrieves quote snapshots from Eastmoney, daily kline data from Tencent, and basic index breadth, then computes simple moving averages and returns. It outputs raw JSON and contains no report generation, no portfolio analytics, no web browsing/searching, no evidence synthesis, and no reasoning workflow. While the market data sources partially align with the description, the actual behavior is materially narrower and lacks the core declared capabilities, so this is a clear description-behavior mismatch.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill invokes network-capable workflows and references external data retrieval, but it does not declare an explicit tool scope or permissions boundary. That creates an authorization and governance gap: the skill may be able to access broader tools or destinations than reviewers and orchestrators expect, increasing the chance of unintended data access or misuse.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The description uses broad trigger phrases that can cause the skill to activate for loosely related finance queries without clear boundaries. Over-broad routing is dangerous because it can unexpectedly invoke networked analysis behavior, increase data exposure, and produce authoritative-seeming financial output in situations where the skill is not actually appropriate.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The file mandates a fixed Chinese output structure for each stock analysis item, and the surrounding instructions consistently prescribe Chinese-language headings and labels. There is no indication that the user can choose another language or locale, which is a natural-language policy concern under the language/locale rule.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The required final structure is specified entirely with Chinese section titles and presented as mandatory. Because the skill does not document that this is a region-specific exception or offer language selection, it risks forcing a locale-specific output without user consent.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The title explicitly specifies a Chinese-language report format, and the rest of the template is entirely written in Chinese with no indication that another language is allowed. This creates a natural-language policy concern because it imposes a specific language/locale without user opt-in or documented regional justification.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown file contains operational guidance only in Chinese, which can amount to forcing a specific language on users without opt-in. The policy for SQP-3 requires flagging language or locale constraints unless the skill offers a choice or clearly documents a justified regional limitation.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: This Python code sends the user-supplied `--codes` values to Eastmoney and Tencent over HTTP(S) via `fetch_quotes` and `fetch_kline`. Although the module docstring names the data sources, there is no explicit warning in the CLI help, output, or comments near execution that entered symbols will be shared with external services.

Static analysis

No suspicious patterns detected.