Security audit

DolphinDB 流式计算技能

Security checks across malware telemetry and agentic risk

Overview

This skill is not clearly malicious, but it needs review because its examples repeatedly use weak admin database credentials and include an automated trading execution pipeline without clear user controls.

Install only if you will replace the sample admin/123456 credentials, use a least-privileged DolphinDB account, and keep execution-related examples disabled or paper-trading until you have explicit approvals, limits, and rollback procedures. VirusTotal was pending and static scan was clean, so the concern is about unsafe scope and examples rather than confirmed malware.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The skill repeatedly embeds hard-coded `admin` credentials (`password="123456"`) in sample connection code without any warning that they are placeholders or unsafe defaults. This normalizes insecure practices and can lead users to deploy privileged accounts with trivial passwords, enabling unauthorized database access and full compromise of DolphinDB instances.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.