Security audit

维加斯通道交易

Security checks for vulnerabilities and agentic risk

Overview

This trading-analysis skill is not clearly malicious, but it asks for broad execution authority and discusses API keys and live trading without enough concrete boundaries or safeguards.

Review this skill carefully before installing. Treat it as advisory only, do not provide broker or market-data credentials unless you understand where the agent stores and logs them, and do not allow live trading or shell execution from this skill without separate, explicit controls and confirmations.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The manifest presents a narrowly scoped A-share trading analysis skill, but the body expands into vague 'workflow' and execution-adjacent capabilities without clear boundaries. This scope mismatch is dangerous because it can cause an agent or user to over-grant trust and permissions to a skill whose actual behavior is underspecified, especially when exec is also enabled.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The documentation claims external integrations, API-key handling, TradingView sync, backtesting, and live trading workflows, but the file provides no implementation details or controls for those high-risk actions. This is dangerous because users may assume the skill safely supports credentialed network access and trading operations when in reality the behavior is unverifiable and could lead to unsafe deployment assumptions.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill declares shell execution capability even though its stated function is financial analysis and decision support, creating unnecessary access to powerful system operations. In this context, exec materially increases risk because a trading-analysis skill does not need shell access, yet it may also handle API keys and external data, making credential exposure or arbitrary command execution more plausible.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The document asserts security hardening and elimination of sensitive-exposure paths while simultaneously discussing command execution and environment-variable API key handling. This contradiction is dangerous because it creates false assurance: operators may trust the skill as pre-hardened even though the declared capabilities still include common paths to credential leakage and command abuse.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The skill description uses broad, ambiguous language about capabilities and scenarios without clear trigger conditions or limits. This is dangerous because vague invocation criteria can cause overbroad activation, unintended use in unrelated contexts, and accidental exposure of high-privilege tools such as exec.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README instructs users to configure API keys and proceed toward live trading workflows without prominent warnings about secret handling, financial risk, or the consequences of automated decisions. In a trading context, this is more dangerous because misuse can expose credentials and affect real-money activity, not just test data.

Static analysis

No suspicious patterns detected.