Security audit

选股雷达

Security checks for vulnerabilities and agentic risk

Overview

This stock-analysis skill is not clearly malicious, but it asks for broad command execution and file/API handling that are not tightly scoped to stock screening.

Review before installing. The stock-analysis purpose is coherent, but only use this skill if you are comfortable giving it command-execution capability and access to local files/API-key configured data sources. Treat outputs as informational market analysis, not investment advice, and require explicit confirmation before any command execution, file writes, or credential-backed API use.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is declared as a focused stock-radar tool, but the documentation later broadens scope into generic file handling, API integration, and command execution. This mismatch increases the chance that an agent will grant or invoke capabilities unrelated to the user’s financial task, creating unnecessary attack surface and confusing safety boundaries.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The manifest exposes the exec tool even though the stated skill purpose is stock screening and market analysis. Unnecessary command-execution capability is dangerous because prompt content or downstream logic could cause the agent to run local commands, access files, or alter the environment beyond the intended business function.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The document claims sensitive paths and external references were removed, yet it still includes API key handling, external APIs, file operations, and command execution. This inconsistency can mislead reviewers and users into underestimating the real privileges and data-exposure paths of the skill.

Vague Triggers

High

Confidence: 90% confidence
Finding: The activation condition is overly broad, indicating the skill should be used whenever a user needs stock-radar-related functionality, with vague surrounding language and expansive positioning. Broad matching can cause the skill to activate in loosely related contexts, increasing the risk that high-privilege tools are invoked when unnecessary.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill provides financial scoring and decision support but does not clearly warn users that outputs are not investment advice and may be incomplete or wrong. In a financial context, omission of this warning increases the chance users will over-trust automated outputs and act on potentially flawed recommendations.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill documentation mentions file writing and command execution without an explicit warning that these actions may affect the host system. In combination with the exec capability, this can normalize unsafe behavior and reduce the likelihood of user confirmation before impactful operations.

Static analysis

No suspicious patterns detected.