Security audit

选股雷达

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly an A-share stock analysis helper, but it also asks for command execution and generic file handling in ways that are not tightly scoped to that purpose.

Review this before installing if you do not want a stock-analysis skill to have shell-command capability. It does not contain bundled malware or automatic destructive behavior, but its exec and generic file-handling scope should be narrowed or used only in an environment where command execution is acceptable.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill is presented as a stock-analysis tool, but the documentation later introduces generic file processing, API integration, and command execution capabilities that materially expand its authority beyond the stated purpose. This mismatch can cause an agent to invoke read/exec behaviors under a benign financial-analysis pretext, increasing the chance of unintended filesystem access or shell command execution.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The documentation claims that risky code and external references were removed and that security was enhanced, yet the skill still declares the exec capability in metadata. Such reassuring security language can lower reviewer and user vigilance while the skill retains the ability to run commands, creating a misleading trust signal around a sensitive permission.

Vague Triggers

High

Confidence: 89% confidence
Finding: The activation text says to use the skill whenever the user needs stock-radar-related functionality, but does not define clear boundaries for what requests are in-scope. Overly broad trigger language can cause an agent to route loosely related requests into a skill that has read and exec permissions, enabling unnecessary exposure to privileged actions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The markdown advertises file processing and command execution capabilities without prominent warnings, consent requirements, or constraints on system-impacting actions. In a skill that already declares read and exec tools, this can normalize unsafe operations and increase the risk that an agent performs filesystem changes or shell actions the user did not clearly authorize.

Static analysis

No suspicious patterns detected.