Security audit

Edgar Crawler

Security checks for vulnerabilities and agentic risk

Overview

This skill is labeled as an SEC filing crawler, but its instructions also steer users into unrelated quant trading and ZVT workflows.

Install only after reviewing the scope carefully. If you want SEC filing downloads, do not provide broker, wallet, JoinQuant, QMT, or paid-provider credentials, and do not run ZVT setup or backtesting commands unless you intentionally want that separate quant workflow.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill advertises SEC EDGAR filing collection, but the main body pivots into unrelated trading, backtesting, A-share/HK/crypto market selection, and execution pipeline guidance. This mismatch can cause an agent to invoke the wrong capability, collect incorrect inputs, or enter higher-risk trading workflows when the user only requested document retrieval, which is a serious capability-confusion issue in agent systems.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The use case claims SEC EDGAR extraction, but adjacent prompts request Chinese-market data providers, strategy types, and backtest parameters that are unrelated to EDGAR. In an autonomous agent context, this can steer execution into unintended domains, increasing the chance of unauthorized data access, mis-execution, or accidental invocation of trading-related components instead of a simple filing download workflow.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The human-facing summary materially conflicts with the declared skill purpose: instead of describing an SEC EDGAR 10-K/10-Q crawler, it advertises a ZVT-based quant strategy assistant focused on A-share/HK/crypto. This can cause the agent to invoke the wrong skill for unrelated finance requests, creating capability confusion, misrouting, and potential execution of unintended workflows under a misleading identity.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The tagline and capability list actively describe a different product domain than the manifest, which is a strong integrity problem in skill metadata. When capability descriptions are mismatched, planners and users may trust the wrong affordances, leading to inappropriate invocation, unsafe downstream actions, or disclosure of data to a skill not intended for that task.

Description-Behavior Mismatch

Critical

Confidence: 98% confidence
Finding: The manifest is supposed to define an EDGAR filing crawler, but large sections instead describe a ZVT-based A-share trading/backtesting skill with trading stages, strategy scaffolds, acceptance gates, and semantic locks unrelated to EDGAR retrieval. This capability mismatch is dangerous because it can cause the host to invoke code generation or execution paths far beyond the user-declared purpose, violating least privilege and creating unexpected trading or local file operations under a misleading skill identity.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The install/strategy scaffold exposes backtest, training, serving, and research entry points even though the skill is presented as a filing crawler. That unjustified expansion of execution modes increases the attack surface and may let a benign document-fetch request trigger code paths that write results, execute backtests, or otherwise affect the workspace in ways the user did not consent to.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Backtesting preconditions and semantic locks such as sell-before-buy, MACD parameter locks, and trading signal contracts are context-inappropriate for a filing extraction tool. Their presence indicates the runtime may enforce or expose unrelated financial-trading behavior, which makes the skill materially more dangerous because a user seeking document retrieval could be routed into strategy or trade-oriented workflows.

Intent-Code Divergence

Critical

Confidence: 98% confidence
Finding: The human_summary and post-install messaging advertise A-share quant strategy and backtesting capabilities that contradict the stated EDGAR crawler purpose. Misleading user-facing documentation is dangerous in an agent skill because it can socially engineer users and the host into authorizing broader actions than expected, masking the true operational scope of the skill.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger condition is broad enough to activate on generic verbs like run, execute, fetch, or collect whenever loosely matched terms appear. Ambiguous activation increases the risk of accidental tool invocation, especially because the rest of the document contains mixed domains; that combination can route users into the wrong workflow or cause unrequested external access.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Phrases like 'Just tell me what you want; I'll write the code' are overly broad and can match common user requests far outside the skill's stated purpose. In the context of a mislabeled skill, this broad language increases the chance of accidental triggering and expands the blast radius of the domain-confusion issue.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The execute trigger matches on broad action verbs like run, execute, fetch, collect, and Chinese equivalents combined with generic finance terms, which can over-trigger on unrelated user requests. In an agent context, ambiguous triggers are risky because they can launch network and file-writing workflows without sufficiently specific user intent.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The manifest describes network downloads and file-writing behavior but lacks a clear up-front warning to users that executing the skill will perform external HTTP requests and persist data locally. This reduces informed consent and makes accidental system-affecting operations more likely, especially when paired with broad execution triggers.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The user-facing language imposes an A-share/ZVT framing even though the declared use case is SEC EDGAR extraction. This mismatch increases the chance of user confusion, mis-scoped execution, and accidental invocation of unrelated finance/trading workflows, which is especially problematic in an agent environment where text guides behavior.

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: The human summary explicitly biases toward A-share workflows and discourages other markets, despite this skill being labeled as a multi-market EDGAR crawler. This misleading orientation can cause incorrect assumptions about supported actions and obscure the actual external-download behavior of the skill.

Static analysis

No suspicious patterns detected.