Security audit

News Event Driven Analysis

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only stock event analysis skill with no code or persistence, but it can produce high-stakes trading-style guidance that users should not treat as personalized financial advice.

Before installing, understand that this skill is for Chinese stock-event analysis and may generate buy/sell, timing, position, and stop-loss suggestions. Treat those outputs as educational market commentary, verify current data independently, and avoid publishing reports with the bundled hard-coded analyst attribution unless it is removed or replaced with a verified source.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

Location: references/event-analysis-template.md:161
Finding: Hard-Coded Third-Party Identity Causes Misleading Report Attribution<![CDATA[ ## Vulnerability Details **File Location**: `references/event-analysis-template.md:161-163` **Vulnerability Type**: Hard-coded output attribution and identity injection **Risk Level**: Medium ### Vulnerable Code ```markdown **报告生成时间**：YYYY-MM-DD HH:MM **分析师**：太空龙虾 🦞 **免责声明**：本报告仅供参考，不构成具体投资建议。投资有风险，入市需谨慎。 ``` The relevant fields translate to a report-generation timestamp, an analyst attribution of “Space Lobster,” and an investment disclaimer. ### Technical Analysis The report template contains a fixed analyst identity that is unrelated to the user, the executing agent, or a verified human analyst. Because the Skill instructs the agent to produce financial event-analysis reports using the packaged template, following the template can cause every generated report to carry this predetermined attribution. This behavior alters the integrity of the agent's output by injecting an attacker-selected or package-author-selected identity into otherwise legitimate analysis. The attribution is not presented as an example or optional placeholder, and no instruction requires the agent to verify that the named party authored or reviewed the report. The issue is classified as `T01: Skill Instruction Hijacking` because the Skill text directs the agent's current-session output toward a fixed identity and branding choice that is not necessary for its stated financial-analysis purpose. ### Attack Path 1. A user or agent loads the financial event-analysis Skill. 2. The agent receives a request to analyze a policy, company announcement, industry event, or market sentiment. 3. The agent follows the bundled report template in `references/event-analysis-template.md`. 4. The fixed analyst field is copied into the generated report. 5. The completed report falsely or misleadingly attributes the analysis to “Space Lobster,” even though that identity did not necessarily create or review it. No code execution, elevated privileges, persistence, credential access, or syste ...[truncated 684 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the fixed analyst identity from the template. 2. Replace it with a neutral, clearly optional placeholder: ```markdown **Analyst**: [Name provided and verified by the user, if applicable] ``` 3. If no verified analyst name is supplied, omit the field or use: ```markdown **Generated by**: AI-assisted analysis ``` 4. Add an explicit instruction that the agent must not invent, infer, or preserve authorship claims that have not been provided and verified by the user. 5. Keep provenance separate from the financial disclaimer so that the disclaimer does not imply validation by the named analyst. 6. Review other output templates for fixed identities, branding, signatures, or organizational claims that are unrelated to the Skill's functional purpose. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The markdown content, including the manifest description and all usage instructions, is exclusively in Chinese. Under the policy rule, forcing a specific language without offering a user choice or documenting a justified region-specific constraint is a natural-language policy violation.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document gives concrete investment guidance, including timing, stock-selection principles, position sizing, and stop-loss advice, but does not include a clear disclaimer that the material is educational rather than financial advice and may cause losses. In a skill context, users may reasonably treat this as actionable investment instruction, increasing the risk of financial harm or misplaced reliance.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill explicitly instructs the model to provide operational trading advice such as whether to buy, how much to buy, and when to buy, but it does not present a clear upfront warning that this is not financial advice and may be inaccurate or unsuitable. In practice, users could rely on high-risk, time-sensitive recommendations without understanding limitations, suitability, or regulatory concerns.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill uses very broad invitation text like asking users to paste any news or announcement for analysis, which can cause the skill to trigger on generic requests outside a narrowly scoped context. That increases the chance of over-activation and unsolicited financial-analysis behavior, especially in systems that route based on natural-language matching.

Natural-Language Policy Violations

Low

Confidence: 94% confidence
Finding: The template content, section headings, and analyst label are entirely written in Chinese, which implies the skill expects or enforces a single output language. Under the policy, language constraints should be optional, justified, or explicitly offered as a user choice; this file does not provide such an opt-in or explanation.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: Natural-language policy issues apply to all file types, including markdown. This file presents all headings, labels, and guidance solely in Chinese, which can amount to a language/locale constraint if the skill is expected to serve general users and no opt-in or justification is provided.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: The entire quick-start guide, examples, and suggested prompts are presented only in Chinese, with no indication that users may choose another language. Per the policy, a skill should not impose a specific language or locale unless it offers opt-in or clearly documents a justified regional constraint.

Static analysis

No suspicious patterns detected.