Security audit

实时行情跟踪

Security checks for vulnerabilities and agentic risk

Overview

This stock quote skill is mostly documentation, but it asks for shell execution and describes broad file and command handling without clear limits.

Review this before installing. The market-data purpose is understandable, but the skill requests shell execution and describes file writing without clear safeguards. Only install it if you are comfortable granting local command authority, and avoid providing sensitive API keys or private portfolio files unless the publisher narrows the permissions and documents exact command/file boundaries.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The skill claims in its security checklist that it has no eval/exec or untrusted external command execution, yet the metadata explicitly grants the exec tool. This contradiction is dangerous because reviewers or users may rely on the safety claims while the skill still has a capability that can execute commands, expanding the attack surface for arbitrary local actions if later prompts or implementations use it.

Context-Inappropriate Capability

High

Confidence: 93% confidence
Finding: A real-time stock quote skill does not need shell command execution to fetch and aggregate market data, so declaring exec is excessive privilege. Unnecessary command execution materially increases the risk of prompt-influenced command runs, local file access, environment leakage, and misuse beyond the stated finance use case.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The documentation advertises broad file processing and writing capabilities that are not clearly necessary for quote tracking. Extra file-system scope can enable unintended reading or modification of local data, especially when combined with ambiguous workflow descriptions and external data ingestion.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The description asserts that risky code was removed and security improved, but the skill still promotes command execution elsewhere. Such misleading assurance is dangerous because it can lower reviewer vigilance and hide excessive privileges behind trust-building language, especially in adversarial skill content.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill describes file handling and command execution without a prominent warning about their security implications or operational boundaries. In practice, users may invoke the skill for benign finance tasks without realizing it can affect the local environment, increasing the chance of unsafe use or social-engineering-style prompt abuse.

Static analysis

No suspicious patterns detected.