DolphinDB 量化金融技能

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:28 PM UTC
• Version:
  1.4.0

Overview

This is a documentation-only DolphinDB quant-finance skill with insecure example credentials, but no hidden code, exfiltration, or destructive behavior in the artifact.

Install only if you trust the referenced DolphinDB helper skills and scripts. Before using this with real financial or production data, replace admin/123456 with a least-privileged account, change any default DolphinDB password, and review generated DolphinDB scripts before execution.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill repeatedly demonstrates connecting to DolphinDB with hardcoded default administrator credentials (`admin` / `123456`). In a skill document, examples are often copied verbatim into production or shared environments, so this normalizes insecure deployment and can directly lead to unauthorized database access, data theft, tampering, or full administrative control if the defaults remain unchanged.

VirusTotal

65/65 vendors flagged this skill as clean.