Security audit

A Stock Trading Assistant

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent A-share trading assistant, but it needs review because it can base trading guidance on unauthenticated HTTP market data and stores user alerts locally without clear controls.

Review before installing. Use it only for educational analysis, verify prices with a trusted HTTPS broker or data provider before making trades, avoid providing session cookies unless you can store them securely, and periodically review or delete any local watchlist entries it creates.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fetch_stock.py:114
Finding: Plaintext HTTP Transport Permits Manipulation of Decision-Critical Market Data
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger conditions are very broad, covering nearly any Chinese A-share investing conversation and several generic portfolio topics like strategy, alerts, and position sizing. This can cause the skill to activate outside a clearly bounded user intent, increasing the chance of unsolicited financial guidance or unintended tool use in ordinary conversation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to persist user-defined price alerts to a local watchlist file without an explicit notice, consent flow, retention policy, or visibility into what is stored. Persistent storage of user interests or holdings can expose sensitive financial preferences across sessions or to other components if the file is later accessed improperly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document gives explicit investment-oriented buy/sell signals such as 'strong buy signal' and 'strong sell signal' without any warning about financial risk, uncertainty, or suitability. In a skill context, users may treat this as actionable financial advice and make trading decisions without understanding the limitations, which can lead to monetary loss and potential compliance issues.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document recommends several third-party market data APIs and includes multiple plain-HTTP examples, but provides no warning that requests transmit query data to external services and may be vulnerable to interception or tampering when unencrypted. In a skill likely to be reused by agents or scripts, this can normalize insecure transport and cause users to unknowingly send requests over insecure channels to unaffiliated providers.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The Xueqiu section tells users to obtain a session cookie and use it for API access, but gives no warning about protecting session material or limiting its use. Session cookies are effectively bearer credentials; careless handling can lead to account/session hijacking, unauthorized requests, or leakage through logs, shared scripts, or prompts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The instructions define the assistant as serving only the China A-share market and the surrounding content is entirely framed for a single locale without offering user choice. A region-specific scope can be acceptable, but here there is no explicit opt-in or justification framed as a locale constraint policy, so it reads as a hard-coded locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: All natural-language instructions in this file are presented exclusively in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. The policy calls for flagging forced language or locale choices when there is no user opt-in or explicit justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The request headers force Accept-Language to zh-CN,zh;q=0.9, which imposes a specific locale preference in network interactions. Under the policy, language or locale constraints should not be forced unless the user is given a choice or the constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.