a-stock-review

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:36 PM UTC
• Version: 1.0.1

Overview

This stock-report skill is not malware, but it warrants review because it pushes actionable trading advice and contains misleading or under-scoped implementation details.

Install only if you are comfortable with a finance skill that contacts Chinese market-data providers and may generate highly actionable trading language. Treat any output as informational, verify ticker/name/date/source consistency yourself, and do not rely on its position sizing, stop-loss, or buy/sell language as personalized investment advice.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The code is broadly aligned with the general idea of producing an A-share stock review report via AkShare, so the primary purpose matches at a high level. However, the declared description materially overstates the implemented scope. The implementation only covers historical行情, realtime quote fields, a small hardcoded板块/概念 mapping, basic MA calculations, and a simple heuristic rating. It does not fetch or analyze financial statements or richer fundamental indicators, does not perform any资金流向 analysis, and does not provide comprehensive sector/concept analysis through AkShare. Therefore, the description is not fully accurate relative to actual behavior, and this should be flagged as a mismatch due to significant missing declared capabilities.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The declared description broadly matches the domain and primary purpose: this is indeed a stock analysis/reporting tool for A-shares, using AkShare and supplemental web requests to gather market data, fund flow, sector information, and announcements. Those capabilities are aligned. However, the description overstates the implemented functionality in material ways. The code does not actually provide comprehensive financial indicator analysis or technical analysis; it mainly aggregates raw market/fund-flow/sector/announcement data into a report. In addition, the generated report title and sector lookup are hard-coded to 新天然气(603393) and 燃气, which means the implementation is less general than the declared description suggests. Therefore, this is a description-behavior mismatch, though not a completely unrelated one.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the model to generate 'trade-executable' stock reports and actionable conclusions without any financial-risk warning, suitability check, or limitation language. In this context, the absence of safety framing is dangerous because users may treat generated output as professional investment advice and make high-impact financial decisions based on unverifiable or incomplete data.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill goes beyond analysis and prescribes concrete buy/add/reduce/stop-loss actions, position sizing, and tactical execution steps, again without warnings about financial loss, model limitations, or user suitability. That is especially risky in a finance skill because the surrounding context is designed to maximize perceived authority and actionability, making harmful reliance more likely.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill requires external market data retrieval and cross-source verification, but it declares no explicit tool scope or allowed network permissions. This creates an unbounded network access pattern where the runtime may permit broader outbound requests than necessary, increasing the risk of unintended data exfiltration, dependency on untrusted endpoints, or future prompt-driven misuse.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: All user-facing strings, usage text, and report content are hard-coded in Chinese, and stdout is explicitly configured for UTF-8 output. The file does not provide any opt-in, configuration, or documented justification for restricting the skill to a single language/locale.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The Accept-Language header forces a zh-CN/Chinese-preferred locale order for all requests. This is a natural-language locale policy issue because the user is not given a choice and the code does not document why a Chinese locale is required.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The retry helper deliberately introduces random delays and explicit handling for 403/429 responses to avoid anti-scraping controls, which goes beyond ordinary reliability logic and is aimed at continuing access despite rate limiting. In this stock-analysis context, that behavior increases legal/compliance risk and may cause the host environment to participate in abusive scraping against third-party services.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The generated report header hardcodes '新天然气(603393)' regardless of the user-supplied stock code, creating a misleading output that can cause users to act on analysis attributed to the wrong company. In a financial-analysis skill, this is especially dangerous because inaccurate attribution can directly affect trading or investment decisions.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The function fetches stock history from an external AkShare data source, which is a network operation. While the file contains a financial disclaimer, there is no explicit warning, comment, or user-facing notice that running the script will contact external services to retrieve market data.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: This call retrieves real-time stock data through AkShare, which implies outbound network access. The script does not clearly inform the user that executing it will perform external requests, beyond the functional output itself.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The skill performs outbound requests to multiple third-party market data providers without clearly disclosing that user inputs will trigger network access. While common for data-fetching tools, undisclosed network activity can create privacy, compliance, and operational surprises for users or hosting platforms.

Static analysis

No suspicious patterns detected.