Security audit

a-stock-review

Security checks for vulnerabilities and agentic risk

Overview

This stock-report skill is not malware, but it warrants review because it pushes actionable trading advice and contains misleading or under-scoped implementation details.

Install only if you are comfortable with a finance skill that contacts Chinese market-data providers and may generate highly actionable trading language. Treat any output as informational, verify ticker/name/date/source consistency yourself, and do not rely on its position sizing, stop-loss, or buy/sell language as personalized investment advice.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The code is broadly aligned with the general idea of producing an A-share stock review report via AkShare, so the primary purpose matches at a high level. However, the declared description materially overstates the implemented scope. The implementation only covers historical行情, realtime quote fields, a small hardcoded板块/概念 mapping, basic MA calculations, and a simple heuristic rating. It does not fetch or analyze financial statements or richer fundamental indicators, does not perform any资金流向 analysis, and does not provide comprehensive sector/concept analysis through AkShare. Therefore, the description is not fully accurate relative to actual behavior, and this should be flagged as a mismatch due to significant missing declared capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The declared description broadly matches the domain and primary purpose: this is indeed a stock analysis/reporting tool for A-shares, using AkShare and supplemental web requests to gather market data, fund flow, sector information, and announcements. Those capabilities are aligned. However, the description overstates the implemented functionality in material ways. The code does not actually provide comprehensive financial indicator analysis or technical analysis; it mainly aggregates raw market/fund-flow/sector/announcement data into a report. In addition, the generated report title and sector lookup are hard-coded to 新天然气(603393) and 燃气, which means the implementation is less general than the declared description suggests. Therefore, this is a description-behavior mismatch, though not a completely unrelated one.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs the model to generate 'trade-executable' stock reports and actionable conclusions without any financial-risk warning, suitability check, or limitation language. In this context, the absence of safety framing is dangerous because users may treat generated output as professional investment advice and make high-impact financial decisions based on unverifiable or incomplete data.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill goes beyond analysis and prescribes concrete buy/add/reduce/stop-loss actions, position sizing, and tactical execution steps, again without warnings about financial loss, model limitations, or user suitability. That is especially risky in a finance skill because the surrounding context is designed to maximize perceived authority and actionability, making harmful reliance more likely.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill requires external market data retrieval and cross-source verification, but it declares no explicit tool scope or allowed network permissions. This creates an unbounded network access pattern where the runtime may permit broader outbound requests than necessary, increasing the risk of unintended data exfiltration, dependency on untrusted endpoints, or future prompt-driven misuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: All user-facing strings, usage text, and report content are hard-coded in Chinese, and stdout is explicitly configured for UTF-8 output. The file does not provide any opt-in, configuration, or documented justification for restricting the skill to a single language/locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The Accept-Language header forces a zh-CN/Chinese-preferred locale order for all requests. This is a natural-language locale policy issue because the user is not given a choice and the code does not document why a Chinese locale is required.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The retry helper deliberately introduces random delays and explicit handling for 403/429 responses to avoid anti-scraping controls, which goes beyond ordinary reliability logic and is aimed at continuing access despite rate limiting. In this stock-analysis context, that behavior increases legal/compliance risk and may cause the host environment to participate in abusive scraping against third-party services.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The generated report header hardcodes '新天然气(603393)' regardless of the user-supplied stock code, creating a misleading output that can cause users to act on analysis attributed to the wrong company. In a financial-analysis skill, this is especially dangerous because inaccurate attribution can directly affect trading or investment decisions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The function fetches stock history from an external AkShare data source, which is a network operation. While the file contains a financial disclaimer, there is no explicit warning, comment, or user-facing notice that running the script will contact external services to retrieve market data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This call retrieves real-time stock data through AkShare, which implies outbound network access. The script does not clearly inform the user that executing it will perform external requests, beyond the functional output itself.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill performs outbound requests to multiple third-party market data providers without clearly disclosing that user inputs will trigger network access. While common for data-fetching tools, undisclosed network activity can create privacy, compliance, and operational surprises for users or hosting platforms.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.