Value Nvest Perspective

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 0.1.0

Overview

This is a coherent stock-and-options guidance skill, but it gives broad actionable leveraged-trading advice without enough risk and suitability guardrails.

Install only if you want a Chinese-language US stock and long-call commentary framework, and treat its outputs as informational market analysis rather than personalized financial advice. Before acting on any recommendation, independently check current prices, risk tolerance, time horizon, options experience, and position size; be especially cautious with long calls because they can lose value quickly. Prefer a pinned and verified install command instead of the unpinned `npx` example.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:140

Finding

Unpinned Third-Party Package Executed During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md:140
Vulnerability Type: Unpinned remote package execution through npx
Risk Level: Medium

Vulnerable code:

bash

npx skills add ting2tao/value-nvest-skill

Technical Analysis

The documented installation command invokes the remotely resolved skills npm package through npx without specifying an exact version. The project does not provide a lockfile, package checksum, registry restriction, or other integrity control for this installer.

Because npx can download and execute a package that is not already installed, the effective installer code may differ from the code reviewed during this audit. If the package, its dependencies, its publisher account, or the configured npm registry is compromised, following the documented command could execute attacker-controlled code.

This exposure is limited to users who manually run the installation command; the audited Skill documentation does not execute it automatically.

Attack Path

1. An attacker compromises the publisher account, package, dependency chain, or package-resolution source associated with the unpinned skills package.
2. The attacker publishes a malicious version that contains installation-time or runtime code execution.
3. A user follows the installation instructions in README.md and runs the documented npx command.
4. npx resolves and downloads the attacker-controlled package version.
5. The malicious package executes with the privileges and environment access of the user running the command.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. Depending on that user's permissions and environment, the malicious package could access user-readable files, source code, environment variables, development credentials, SSH material, and authenticated developer tooling. It could also modify files or establish pers ...[truncated 253 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer to an exact, reviewed package version, for example:

   bash

   npx --yes skills@<reviewed-version> add ting2tao/value-nvest-skill
   

2. Publish and verify the expected package integrity hash or signed provenance before execution.
3. Document the trusted npm registry explicitly and recommend checking the resolved package identity and version.
4. Maintain a lockfile where installation tooling supports one, and review both direct and transitive dependencies.
5. Prefer a locally included, auditable installation mechanism that does not download mutable executable code at installation time.
6. Recommend running installation with least privilege and without unnecessary secrets in the process environment.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill provides actionable trading guidance, including buy/hold/wait recommendations and options-related suggestions, without an explicit warning that options and concentrated equity strategies carry substantial risk and may be unsuitable for many users. This is more dangerous in context because the skill is specifically designed for leveraged and timing-sensitive decisions, which can cause rapid financial loss if users treat the output as authoritative advice.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The README instructs users to run npx skills add ting2tao/value-nvest-skill without pinning an exact package version. That creates a supply-chain risk because npx may fetch the latest published package or resolve mutable content, so a compromised or newly malicious release could execute unexpected code on the user's machine during installation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation examples are written as imperative trigger phrases in Chinese and the README consistently frames the skill as operating in Chinese, but it does not state that users may choose another language. This can conflict with language/locale policy expectations when a skill implicitly forces a specific language without explicit user opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation criteria are very broad and cover a large class of stock, options, and buy/sell questions, which increases the chance the skill is invoked in situations where specialized compliance, suitability, or risk controls are needed. In this context, overbroad routing is dangerous because the skill gives directional investment guidance and could be applied to users or scenarios outside its intended risk tolerance or jurisdictional assumptions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Most of the instructional content and example outputs are written in Chinese, and the skill does not state that users may choose another language or locale. This can violate language/locale policy when a skill effectively constrains interaction language without explicit user opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This JSON eval file contains prompts and expected behaviors entirely in Chinese, with no indication that language choice is optional or that the skill is region-specific. Under the policy rule for language/locale, this is a natural-language constraint that could force a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file instructs the final skill to repeatedly use the Chinese phrase 不是投资建议, which imposes a specific language choice in the generated output. This is a natural-language locale policy concern because the file does not offer user choice or explain why Chinese wording is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file includes a natural-language example response entirely in Chinese, with no indication that language choice is optional or user-driven. That can violate language/locale policy by implicitly steering the skill to respond in a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This JSON test file contains only Chinese prompts and expected Chinese responses, which encodes a language-specific behavior without any visible opt-in or alternative language handling. Under the policy, forcing a specific language without user choice is a natural-language policy violation applicable to all file types.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This markdown file includes Chinese account naming and zh-CN/zh-HK localized source links alongside English-rendered labels, but does not state whether the skill expects or prefers a particular language or locale. Because SQP-3 applies to natural-language policy around language/locale choice, the absence of an explicit opt-in or justification can be read as an implicit locale assumption.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The source inventory repeatedly hard-codes zh-CN and zh-HK locale URLs, which can reflect a language/locale constraint in the skill's documented sources. Because the file does not explain that these locale-specific links are optional or provide user choice, it may violate the policy against forcing a specific language or locale without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.