CN Stock Move Reason

• Outcome: Review
• Latest audit: Sep 3, 2026 · 11:20 AM UTC
• Version: 0.1.0

Overview

The skill mostly matches its stock-analysis purpose, but it should be reviewed because it can persist learning changes to local skill files and coordinate with optional private/account-related skills.

Install only if you are comfortable with the skill running public-market web requests and a local Python collector. Before regular use, require confirmation for any experience/reference-file update, and only allow private RAG, self-selected-stock, or simulated-account integrations when you specifically intend to use those data sources.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Ae1

High

• Category: analysis-evasion

Content

this workflow says to use another market skill, actually load that skill's `SKILL.md` and required references if the skill is installed or available as a sibli

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill invokes shell commands, performs network collection, and later instructs updating local reference files, but it declares no explicit tool scope or permission boundary. That increases the chance an agent with broader-than-expected ambient privileges will execute network or file-write actions without clear user visibility or least-privilege controls.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The workflow directs the agent to update local experience/reference files after answering, which extends the skill from analysis into persistent state modification. In a repository that may contain private notes or be synced to version control, this can create unauthorized changes, poison future runs, or accidentally persist sensitive user-specific material.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The user-facing description and default prompt are written entirely in Chinese and target A-share analysis without any indication that other languages are supported. This creates a language/locale constraint without user opt-in, which matches the policy category for forced language behavior.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: Line L14 instructs that for direct A-share questions phrased in Chinese examples, the skill should always give a specific assessment format, and the file overall is written as operational guidance for CN-stock analysis in Chinese. There is no explicit user opt-in, language choice, or documented policy justification that the skill must respond in Chinese only, which can violate language/locale choice expectations.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except Exception as exc:
            last_exc = exc
    try:
        result = subprocess.run(
            ["curl", "-L", "--silent", "--show-error", "--max-time", str(timeout), url],
            check=True,
            stdout=subprocess.PIPE,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill is described as collecting public market evidence from web sources for stock-move analysis. While HTTP fetching is expected, invoking an external executable via subprocess adds process-execution capability that is not necessary to the stated purpose and materially exceeds simple in-process data retrieval.

Intent-Code Divergence

Low

• Confidence: 80% confidence
• Finding: L012 says the bundled script is safe and does not read credentials or private materials, but elsewhere the skill instructs use of a private version and local installed sibling skills when available. While not a direct contradiction about the script itself, the overall documentation presents the skill as public-safe while operational guidance can expand into local/private resource usage.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The instruction says 'Reply in Chinese unless the user asks otherwise,' which imposes a default language choice rather than first offering the user a language preference. Under the policy, forcing a specific language without user opt-in is a natural-language locale/language violation.

Intent-Code Divergence

Low

• Confidence: 85% confidence
• Finding: The top-level documentation frames the script as a passive evidence collector for downstream analysis. Later code not only gathers data but also derives sentiment/market-phase hints and emits a detailed 'Codex分析指示' prompt that shapes the analysis, which goes beyond the passive role described.

Description-Behavior Mismatch

Low

• Confidence: 91% confidence
• Finding: The module docstring says it gathers evidence and prints a compact brief for Codex to analyze, implying the script is primarily a collection layer. In practice, it additionally computes qualitative 股吧 sentiment and infers a market phase classification, which are analytical judgments rather than mere evidence collection.

Static analysis

No suspicious patterns detected.