Security audit

CN Market Tape

Security checks for vulnerabilities and agentic risk

Overview

This market-data skill is mostly coherent, but it should be reviewed because a public external source can refresh local data used in financial rankings without strong source pinning or explicit permission bounds.

Review the external data-source dependency before installing. The skill is not trying to trade, delete data, or collect credentials, but it can read market/watchlist context through MX tools and cache downloaded public theme data that affects financial analysis. Install only if you are comfortable with those public sources and the absence of strict permission or source-integrity controls.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the implementation downloads theme assets from a public host such as `daytrading.monster` and writes refreshed local cache files, while the skill presents itself as relying on MX and approved aggregate sources, that is a supply-chain and trust-boundary problem. Operators and users may assume data provenance and network exposure are limited to sanctioned providers, but the hidden external dependency can inject untrusted content into local caches and influence later analysis. In a financial-data skill, provenance errors materially increase the risk of manipulated outputs.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the implementation downloads theme assets from a public host such as `daytrading.monster` and writes refreshed local cache files, while the skill presents itself as relying on MX and approved aggregate sources, that is a supply-chain and trust-boundary problem. Operators and users may assume data provenance and network exposure are limited to sanctioned providers, but the hidden external dependency can inject untrusted content into local caches and influence later analysis. In a financial-data skill, provenance errors materially increase the risk of manipulated outputs.

Ae1

High

Category: analysis-evasion
Content: - `scripts/institutional_survey_heat.py`：机构调研明细的低频抓取、去重和股票/行业/周度聚合。
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: - `scripts/institutional_survey_heat.py`：机构调研明细的低频抓取、去重和股票/行业/周度聚合。
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill specifies behavior that involves reading local files, writing cache files, and making network requests, but it does not declare any explicit tool/permission scope. That creates an over-privileged, under-specified execution surface where an orchestrator may allow broader file or network access than the skill actually needs. In a skill that touches runtime caches and external hosts, missing scope boundaries increases the chance of unintended data exposure or misuse of local filesystem and network capabilities.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The instruction `始终用中文回答` mandates a specific language for all outputs. This is a natural-language locale policy issue because the file does not offer the user any language choice or opt-in, nor does it justify the restriction as region-specific compliance.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The file is entirely written as a Chinese SOP and repeatedly prescribes output phrasing in Chinese, such as specific labels and status text. There is no indication that the user may choose another language, nor any documented justification that this skill is intentionally restricted to a Chinese locale or audience.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The file begins with Chinese-only instructions and does not offer any language choice or explain that the skill is intentionally limited to Chinese-language operation. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The validation requires at least one "zh" label, which hard-codes a Chinese locale expectation into the skill's behavior. Under the policy, forcing a specific language or locale without user opt-in or clear justification is a natural-language policy violation.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: This reference instructs the skill to use fixed Chinese phase labels and Chinese output templates such as `周期位置` and `判断依据`. That can amount to a language/locale constraint without explicit user opt-in, which matches the policy category for natural-language language-choice violations.

Static analysis

No suspicious patterns detected.