Security audit

analyst-fundamentals

Security checks for vulnerabilities and agentic risk

Overview

This stock-analysis skill is mostly coherent, but it needs review because it can run a heavy automated workflow, write many local files, and produce investment-style recommendations despite saying it is not advice.

Install only if you are comfortable with a resource-heavy stock research workflow that opens Eastmoney pages, spawns many subagents, and stores research artifacts locally. Confirm the output path before use, avoid persistent no-timeout workers, and treat any recommendation or position-sizing output as generated research, not financial advice.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The guide expands the skill from stock fundamental analysis into a data-harvesting workflow that creates local directories and writes multiple files. This broadens capability beyond the stated user-facing purpose, increasing the risk of unexpected filesystem side effects and unreviewed data collection behavior.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The document instructs spawning four persistent subagents with no timeout, which materially increases autonomy and operational reach relative to a simple analysis skill. Persistent workers can continue acting on external resources and local files with reduced human visibility, raising the chance of runaway or unintended actions.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The guide gives explicit browser automation steps to scrape Eastmoney pages and save extracted content locally, but the skill is presented as an analysis tool rather than a scraper. Undisclosed network access plus automated extraction can surprise users, violate least privilege, and create compliance and provenance issues for downstream analysis.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger conditions are broad enough to activate on generic stock-related requests without clearly constraining scope or requiring user confirmation. In this skill, activation leads to large-scale external browsing, parallel subagent execution, and local file/report generation, so accidental invocation can cause unnecessary data transmission and non-trivial side effects.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill writes many intermediate files and a final report to disk, but the description does not warn users that persistent local artifacts will be created. This is dangerous because users may assume the analysis is ephemeral, while the workflow stores potentially sensitive research history in predictable local paths.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The workflow sends the stock code and related query context to an external website for retrieval, but the skill does not disclose this network transmission. Even if stock codes are not highly sensitive by themselves, user research intent, watchlists, or proprietary analysis targets may be exposed to third parties through automated requests.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill instructs batch writing Markdown files to a local workspace without warning about creation, overwrite, or persistence behavior. Silent filesystem writes can surprise users, overwrite prior results, and create data management risks, especially when performed by multiple subagents concurrently.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The guide directs requests to a third-party website without disclosing that the skill will make outbound network calls. Hidden external requests can expose metadata such as queried stock symbols and timing, and they violate transparency expectations for an analysis-only skill.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The prompt explicitly instructs the agent to write to a fixed local filesystem path, which can cause unintended file modification without an explicit user confirmation or sandbox boundary. In an agent environment with file tool access, this creates a prompt-driven side effect that could overwrite existing analysis artifacts or be repurposed to modify local data unexpectedly.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The prompt explicitly instructs the agent to write an output file in the workspace but provides no user-facing disclosure or consent boundary around modifying local data. In agentic environments, silent writes can create integrity issues, overwrite prior analyses, or surprise users who expected read-only behavior.

Missing User Warnings

Low

Confidence: 92% confidence
Finding: The prompt explicitly instructs the agent to write to a fixed local filesystem path, which can cause unintended file modification without explicit user confirmation or path validation. Even in a benign analyst workflow, direct write instructions increase the risk of silent overwrites, workspace tampering, or misuse if the stock code or surrounding workflow is manipulated.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The prompt instructs the agent to write directly to a fixed output path and overwrite or create `c3_risk_warnings.md` without any confirmation, disclosure, or safeguard. In an agent setting, silent file writes can destroy prior analysis artifacts or modify user data unexpectedly, especially if the stock code variable resolves incorrectly or the file already exists.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The prompt instructs the agent to write directly to a fixed local filesystem path without any user confirmation or safety check. In an agent environment, this can cause unintended local file modification and normalizes side-effecting behavior from prompt text, which becomes more risky if the stock code or surrounding workflow is attacker-controlled.

Static analysis

No suspicious patterns detected.