Retail Investor Radar

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:22 AM UTC
• Version: 1.1.0

Overview

This stock-analysis skill uses disclosed market-data and DeepSeek API integrations, with some privacy and output-integrity risks users should understand before use.

Install and run this only if you are comfortable providing a DeepSeek API key and sending the selected stock plus fetched market/news context to DeepSeek. Treat generated reports as informational, verify important claims against primary sources, and consider running it in an isolated Python environment with pinned dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: report.py:120

Finding

Untrusted News Content Is Inserted Directly into the LLM Instruction Context

Content

View full analysis

list: try: df = ak.stock_news_em(symbol=code) if df is None or df.empty: return [] news = [] for _, row in df.head(count).iterrows(): news.append({ "title": str(row.get("新闻标题", "")), "date": str(row.get("发布时间", "")), "source": str(row.get("文章来源", "")), }) return news ``` The externally sourced values are interpolated directly into the model prompt: ```python if news: lines.append("【近期新闻】") for i, n in enumerate(news, 1): lines.append(f"{i}. [{n.get('date','')}] {n.get('title','')}（来源：{n.get('source','')}）") lines.append("") ``` The resulting text is placed in the same instruction context as the report-generation requirements: ```python def build_prompt(data: dict, style: str = "casual") -> str: style_text = STYLE_PROMPTS.get(style, STYLE_PROMPTS["casual"]) data_text = build_data_summary(data) stock_name = data.get("basic", {}).get("name") or data.get("stock", {}).get("name") return f"""{style_text} 请根据以下数据，为 {stock_name} 写一份个股体检报告。 {data_text} 报告格式要求（严格按照以下结构输出，不要加任何额外说明）： 📊 【今日行情】 （2~3句话说明今天的价格和涨跌情况，结合近期走势给出判断） 💪 【财务健康度】 （用大白话解读毛利率、ROE、负债率等核心财务数据，给出"健康/一般/需注意"的整体评价） 🎯 【估值水位】 （解读PE和PB，判断当前估值是高还是低，对比行业给出参考） 🌊 【主力资金动向】 （解读主力净流入数据，判断主力是在买入、卖出还是观望） 📰 【近期热点】 （总结近期新闻，分析对股价可能的影响） ⚡ 【总体体检结论】 （综合各维度，用1~2句话给出整体判断，态度要明确，不要模棱两可） ⚠️ 【风险提示】 以下内容由AI根据公开数据自动生成，仅供参考学习，不构成任何投资建议。股市有风险，投资需谨慎，请结合自身情况独立决策。""" ``` ### Technical Analysis News titles, dates, and source names originate from an external se ...[truncated 2244 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:12

Finding

Third-Party Python Dependencies Are Installed Without Version or Integrity Pinning

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tainted flow: 'headers' from os.environ.get (line 164, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · report.py (reported line 174)May include surrounding context.

python

"max_tokens": max_tokens,
        "temperature": temperature,
    }
    resp = requests.post(DEEPSEEK_URL, headers=headers, json=payload, timeout=60)
    resp.raise_for_status()
    return resp.json()["choices"][0]["message"]["content"].strip()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares required environment variables and references code files that will read configuration, write logs/config, and make network calls, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap: a host may expose broader file, network, or secret access than the skill actually needs, making misuse or overreach harder to constrain and audit.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are very broad and match common investment questions like asking whether a stock is worth buying or checking a ticker. Overly broad activation can cause the skill to run unintentionally in normal conversation, increasing exposure to network use, external API calls, and investment-oriented responses when the user did not explicitly intend to invoke this skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · report.py (reported line 15)May include surrounding context.

python

from datetime import datetime


DEEPSEEK_URL = "https://api.deepseek.com/v1/chat/completions"

STYLE_PROMPTS = {
    "casual": """你是一个接地气的股票分析博主，专门帮普通散户看懂股票。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The style prompts and output instructions are written to require Chinese-language report generation, with no option for the user to select another language or locale. This is a natural-language policy issue because the skill imposes a specific language by default rather than offering a choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest describes a skill that analyzes A-share stocks using public data and generates a report. In this file, the skill additionally depends on reading a local environment secret (DEEPSEEK_API_KEY), which is a credential-access capability not mentioned in the stated purpose and not obviously inherent from the manifest text alone.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This code transmits the constructed prompt and market/news data to an external LLM provider over the network. In the context of a stock-analysis skill, external transmission is expected, but it still represents a real data-sharing boundary and can expose user inputs and aggregated context to a third party.

Content

Scanner excerpt · report.py (reported line 174)May include surrounding context.

python

"max_tokens": max_tokens,
        "temperature": temperature,
    }
    resp = requests.post(DEEPSEEK_URL, headers=headers, json=payload, timeout=60)
    resp.raise_for_status()
    return resp.json()["choices"][0]["message"]["content"].strip()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill sends compiled stock/news data to a third-party API without any visible just-in-time disclosure or consent mechanism in this file. Even if the data is mostly public market data, user queries, selected tickers, and aggregated report context are still transmitted externally, which creates a privacy and transparency issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The module description and usage examples are entirely in Chinese, including the skill name and invocation guidance. Under the policy criteria, a skill that imposes a specific language without opt-in or explicit justification can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest describes pulling public stock data and generating an analysis report, but does not disclose dependence on an external LLM provider or the need to access runtime secrets. Reading an API key from environment variables is a distinct capability beyond simple public-data retrieval and is not clearly justified by the stated scope alone.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The natural-language comments and labels in this config are exclusively Chinese, which can impose a language choice on users without offering an alternative. Under the policy, forced language or locale without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This Python file contains natural-language documentation and runtime messages exclusively in Chinese, including installation errors and operational warnings. Under the policy rule for language/locale, this is a violation because the skill imposes a specific language without explicit user opt-in or an offered alternative.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest frames the skill as an analysis/report-generation tool, but this entrypoint also creates a logs directory and writes dated log files, and later persists generated reports to disk. Local persistence is not necessarily unsafe, but it is additional behavior not described in the user-facing skill description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest says the skill generates a comprehensive stock checkup report, but this implementation also persists the report as a local text file by default. That storage side effect goes beyond the plainly described behavior of analyzing and presenting results.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.