Stock Pattern Screener

• Outcome: Review
• Latest audit: May 28, 2026 · 4:42 AM UTC
• Version: 0.3.3

Overview

This is not clearly malicious, but it is advertised as a stock-pattern screener while its instructions cover much broader server, authentication, social-session, database, MCP, and write-capable finance workflows.

Install only if you intend to use a broad finance automation assistant, not just a simple chart-pattern screener. Keep it sandboxed, avoid granting broker, paid-provider, social-media, or server credentials unless you have reviewed the exact flow, and require explicit approval before any migration, reset, watchlist write, MCP action, or order-related workflow.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (21)

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill is presented as a stock-pattern screener, but its documented pipeline and use cases include server bootstrap, authentication, and live trading execution. This kind of scope expansion increases the attack surface and can cause users or orchestrators to grant the skill broader permissions than its declared purpose justifies, enabling unintended code paths with operational or financial consequences.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Including a server authentication service in a stock screening skill is unjustified by the stated business purpose and suggests hidden or unnecessary privileged functionality. Even if not overtly malicious, exposing auth logic where it is not expected can lead to credential handling, token misuse, or privilege confusion by downstream agents and operators.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: FastAPI bootstrap capability is unrelated to the claimed role of a pattern screener and broadens the runtime behavior from analytics into service hosting. That increases exposure to network-facing risks, accidental deployment, and hidden execution paths that users would not reasonably expect from a screening-only skill.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The documentation extends the skill from deterministic pattern screening into backtesting, strategy selection, market data provider selection, and broader trading operations. This mismatch can mislead users into invoking the skill for actions involving data access and trading workflows they did not intend, especially in agentic environments that rely on metadata for routing and trust decisions.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The skill claims to be a stock pattern screener, but the embedded descriptions indicate a broader multi-function trading platform. Misrepresenting capability scope is dangerous because operators may approve or invoke the skill under a narrower trust model than its actual behavior warrants, creating room for unauthorized actions or unsafe automation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The human summary materially misrepresents the skill as a broad quant-strategy and code-writing assistant rather than a constrained stock-pattern screener. This can cause users or downstream agents to invoke the skill for out-of-scope tasks, increasing the chance of unsafe code generation, unintended data access, or execution of capabilities not reviewed for this skill.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The listed use cases include unrelated tasks such as database migration, CLI workflows, and FastAPI bootstrap, which are far outside the stated stock-pattern screener purpose. In an agent setting, this kind of capability inflation is dangerous because it may route privileged or sensitive tasks to a skill that was not designed, permissioned, or security-reviewed for them.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The use-cases file describes a backend platform with authentication, MCP server integration, social-media ingestion, database migrations, watchlist writes, and other capabilities far beyond a narrow stock-pattern screener. This scope mismatch can mislead reviewers and downstream agents about the skill’s real authority and accessible components, increasing the risk of over-privileged deployment, unintended tool exposure, or hidden functionality being trusted under an innocuous label.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The seed file materially exceeds the declared scope of a stock-pattern screener by exposing unrelated capabilities such as API bootstrap, auth, migrations, MCP integration, and social-data collection. This scope mismatch is dangerous because users, hosts, or policy layers may grant trust and permissions based on the narrow skill description while the artifact actually enables much broader actions.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The human-facing summary positions the skill as a ZVT/A-share quant assistant, while the rest of the file defines a broader Hermes stock-screener/backend platform. Misleading capability framing increases the chance that users approve execution, installation, or data access without understanding the real behavioral surface.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Including watchlist write capability in a skill advertised as a stock-pattern screener expands the action surface from analysis into state-changing operations on external systems. That is dangerous because an invoking user may expect read-only screening behavior while the skill can modify server-side watchlists through agent/MCP pathways.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Twitter/X authentication and social-media collection are unrelated to the stated technical stock-pattern screening purpose and introduce credential handling, browser session, and third-party data collection risks. Hidden expansion into account-linked external collection increases attack surface and may cause users to expose credentials or authorize unintended network actions.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Database migration capability is operationally powerful and unrelated to a stock-pattern screener's expected function. If triggered unexpectedly, it can alter schemas or runtime data structures, creating integrity and availability risk far beyond normal screening operations.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger terms for use case activation are broad and generic, which can cause unintended invocation in unrelated conversations. In an agent ecosystem, ambiguous routing conditions may activate this skill when the user merely discusses APIs or servers, leading to accidental execution of sensitive or irrelevant behaviors.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: Authentication trigger phrases like generic auth-related terms are too common and can match benign user discussions. This raises the chance that an unrelated conversation triggers security-sensitive functionality, which is especially risky because auth flows often involve secrets, tokens, or identity state.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: Pattern-detection trigger terms are short and ambiguous, making accidental invocation plausible during ordinary market discussion. While less severe than auth exposure, this can still lead to unintended data processing, noisy routing, and execution of workflows the user did not request.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The global execute trigger condition is overly broad, combining positive terms with common action verbs like run, execute, fetch, or collect. In a skill that also references trading and data operations, such ambiguity can cause unintended end-to-end execution, including sensitive financial workflows, based on loosely matching language.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The execute trigger uses broad intent matching combined with common action verbs, which makes accidental or adversarial invocation much easier. In a skill that already has hidden breadth, over-broad routing can cause unrelated user requests to enter powerful execution paths without informed intent.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: Single generic sample triggers like 'api', 'server', 'auth', or 'setup' are ambiguous and overlap with ordinary conversation, increasing the likelihood of unintended invocation. Because this file bundles many unrelated capabilities, ambiguous triggers raise the risk of dispatching into the wrong workflow or privilege domain.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The manifest specifies automatic skill-file creation after hard gates pass, but does not provide strong upfront user disclosure that a file will be written. Silent persistence is risky because it creates durable artifacts and may surprise users who expected a transient analysis or execution flow.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Advertising watchlist write capability without a prominent up-front warning obscures that some flows are state-changing rather than read-only. Users may consent to a screener expecting passive analysis, yet the skill can modify remote watchlists if routed through those capabilities.

Static analysis

No suspicious patterns detected.