Security audit

新闻

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a Markdown guide for stock-news sentiment scanning, but it requests command execution and describes callback URLs, file writes, external APIs, and unrelated security-scan features without clear scope or implementation.

Review this carefully before installing. It is not clearly malicious, but it asks for or normalizes broad agent powers that are not well scoped. Only use it in a controlled workspace, avoid providing sensitive prompts or API keys, do not allow callbacks to untrusted URLs, and require explicit approval for any command execution or file writes.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 80% confidence
Finding: The document claims broad file handling, API integration, and system command execution abilities, while later describing the skill as pure Markdown guidance. That mismatch can mislead an agent or user into authorizing powerful operations under the guise of a narrow news-analysis skill, increasing the risk of unnecessary command execution or local data modification.

Description-Behavior Mismatch

Low

Confidence: 77% confidence
Finding: The skill is presented as a specialized news-sentiment analyzer, but the content expands its scope to generic file processing, command execution, and API usage. Overbroad capability framing weakens the principle of least privilege and can normalize dangerous actions that users would not expect from this domain-specific skill.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill accepts a callback URL for asynchronous completion notifications without any warning or restrictions on outbound requests. In an agent context, this can enable unreviewed data transmission to arbitrary external endpoints, creating privacy leakage and SSRF-like risks if internal or sensitive URLs are reachable.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill advertises file write capability without clearly warning that local files may be created or modified. In an agent environment, undocumented write behavior can lead to accidental overwrites, persistence of sensitive data, or changes to project files the user did not intend.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill claims external API integration without warning that user-provided content or fetched data may be sent to third-party services. This creates a data privacy and compliance risk, especially because financial research workflows may involve confidential prompts, tickers under analysis, internal notes, or regulated data.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill advertises system command execution without a prominent warning or clear execution boundaries. In an agent setting, command execution is a high-risk capability because even innocuous-seeming workflows can be turned into arbitrary code execution, filesystem access, network access, or environment-secret exposure if prompts or parameters are abused.

Static analysis

No suspicious patterns detected.