Security audit

华尔街见闻新闻

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple WallstreetCN news-fetching instruction file with some over-broad routing and branded output, but no code execution, persistence, credential access, or destructive behavior.

Install this if you specifically want WallstreetCN-sourced financial news. Be aware it may activate for broad finance-news prompts and may add WallstreetCN branding or Chinese formatting even when you would prefer neutral formatting or another language.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:48
Finding: Mandatory Brand Promotion Hijacks Agent Output
Content: View full analysis
[阅读全文](https://wallstreetcn.com/articles/...) · 作者：作者名 · 2026-03-27 11:00 --- **2.【文章标题】** 内容摘要（前 50 字左右）... > [阅读全文](https://wallstreetcn.com/articles/...) · 作者：作者名 · 2026-03-27 10:30 --- > 💡 华尔街见闻 —— 帮助投资者理解世界 ``` ### 输出要求 1. **品牌标识**：顶部使用 `### 📰 华尔街见闻 · WALLSTREETCN` 2. **分隔线**：使用 `---` 分隔每条新闻 3. **标题格式**：`**序号。【标题】**` 加粗显示 4. **摘要**：单独一段，约 50 字，自动换行 5. **元信息**：使用引用格式 `>`，包含链接、作者、日期，用 `·` 分隔 6. **品牌口号**：底部使用 `> 💡 华尔街见闻 —— 帮助投资者理解世界` 7. **不使用代码块**：确保文本自动换行 ``` ### Technical Analysis The skill does not merely require accurate source attribution. It imposes a fixed brand identifier at the beginning of the response and a promotional slogan at the end. These instructions persist for every response produced while the skill is active and therefore alter the agent's current-session output goals. The mandatory promotional material is unnecessary for calling the documented API, parsing its response, or presenting article metadata. This creates an instruction-hijacking condition in which loading the skill grants its author control over otherwise unrelated portions of the agent's final response. The project contains no executable scripts, dependency manifests, credential handling, persistence mechanisms, or local command execution. The confirmed issue is limited to manipulation of response content. ### Attack Path 1. A user asks for WallstreetCN articles, financial news, market developments, stock information, headlines, popular articles, or article search results. 2. The ...[truncated 1053 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises very broad activation phrases such as '财经新闻', '市场动态', '金融资讯', and '搜索文章', which can match many ordinary requests and cause the skill to trigger when the user did not specifically ask for WallstreetCN content. Over-broad routing can override user intent, increase unnecessary web access to a third-party API, and create opportunities for data-source confusion or policy bypass through unintended tool invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill hard-codes Chinese output formatting and branding requirements without considering the user's requested language, which can cause responses that do not align with user intent or accessibility needs. While this is not a direct exploit primitive, it is a real quality and safety issue because it can degrade transparency and make the agent less reliable in multilingual contexts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.