Security audit

Stock Picker Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed stock-analysis orchestration skill with financial decision framing, but it does not ship executable code, hidden persistence, broker execution, or credential-harvesting behavior.

Install this only if you want an agent to coordinate financial-analysis workflows and draft recommendation labels or target weights. Treat outputs as research, confirm any costly data/news runs, and do not treat governance drafts or target-state language as permission to trade or modify real accounts.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 80% confidence
Finding: The description says the orchestrator routes across data, macro/news, backtesting, earnings quality, valuation, portfolio analytics, and risk skills. Later lines require decision labels via `trade-decision-policy`, showing the actual orchestration scope includes trade-decision functionality not disclosed in the manifest description.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: Line L016 states the skill coordinates other skills and does not replace their domain-specific logic. Yet L172 directs the orchestrator to route approved target-state mutations through `institutional-governance`, indicating involvement in state-mutation workflows that contradict the narrower coordination-only framing.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger conditions use very broad natural-language phrases such as 'Find best stock(s)' and 'Screen this sector,' which can cause accidental invocation in unrelated conversations. In an orchestrator that fans out to multiple dependent skills and external data sources under budgeted limits, unintended activation can expose data, consume API/news budgets, and generate inappropriate financial recommendations without clear user intent.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The manifest description frames the skill as routing stock-analysis requests across analysis skills under budget controls. However, the mandatory output contract includes governance fields such as approval requirement, D1 write intent, and target weights, which goes beyond pure analysis orchestration into decision/governance workflow handling.

Natural-Language Policy Violations

Low

Confidence: 97% confidence
Finding: The instruction "Require downstream outputs to be English when preparing reusable reports or handoff bundles" imposes a language constraint without indicating user choice or opt-in. This is a natural-language policy issue because it forces a specific language regardless of user preference.

Static analysis

No suspicious patterns detected.