Deep Investment Research

• Outcome: Pass
• Latest audit: Jun 10, 2026 · 12:22 PM UTC
• Version: 1.0.8

Overview

This is a disclosed investment-research skill that gathers public financial and policy data, writes local research artifacts, and does not show evidence of hidden exfiltration, destructive behavior, or trade execution.

Install only if you are comfortable with investment topics, tickers, watchlists, and research queries being sent to external search and data providers. Keep API keys in normal environment variables, set SEARCH_SKILL_PATH only to a trusted search helper, and use dedicated output directories rather than sensitive shared folders. Treat the results as research input, not automatic trading advice.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--compact",
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=20)
        if result.returncode != 0:
            return []
        data = json.loads(result.stdout)

• Confidence: 94% confidence
• Finding: result = subprocess.run(cmd, capture_output=True, text=True, timeout=20)

Tainted flow: 'status_path' from os.environ.get (line 317, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

status["agent_notice"] = ("⚠ " + "; ".join(notices)) if notices else ""
        except (FileNotFoundError, json.JSONDecodeError):
            pass  # No existing file, write fresh
    with open(status_path, "w") as f:
        json.dump(status, f, ensure_ascii=False, indent=2)
    
    # Summary

• Confidence: 80% confidence
• Finding: with open(status_path, "w") as f:

Tainted flow: 'SEARCH_SCRIPT' from os.environ.get (line 43, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

def search_ministry(name, query, today):
    """Serper news 兜底：解析相对/绝对日期，按 RECENT_DAYS 过滤，剔除噪音页。"""
    try:
        result = subprocess.run(
            ["python3", SEARCH_SCRIPT,
             "--query", query,
             "--provider", "serper",

• Confidence: 96% confidence
• Finding: result = subprocess.run( ["python3", SEARCH_SCRIPT, "--query", query, "--provider", "serper", "--type", "news", "--time-range",

Tainted flow: 'cmd' from os.environ.get (line 98, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

"--compact",
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=20)
        if result.returncode != 0:
            return []
        data = json.loads(result.stdout)

• Confidence: 98% confidence
• Finding: result = subprocess.run(cmd, capture_output=True, text=True, timeout=20)

Tainted flow: 'output_file' from os.environ.get (line 1019, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

output_dir = DATA_DIR / target_date
    output_dir.mkdir(parents=True, exist_ok=True)
    output_file = output_dir / "policy_gov.json"
    with open(output_file, 'w', encoding='utf-8') as f:
        json.dump(output, f, ensure_ascii=False, indent=2)

    return output

• Confidence: 84% confidence
• Finding: with open(output_file, 'w', encoding='utf-8') as f:

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The methodology explicitly broadens the skill from investment research into political, military, and international 'intelligence' gathering. That materially expands the operational scope beyond the manifest and can cause the agent to collect and synthesize sensitive geopolitical content under the guise of finance research, increasing misuse risk and violating least-privilege/scope expectations.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The template asks for '利好板块/标的' and '利空板块/标的,' which are effectively target-level market implications and can be used as actionable trading guidance. This conflicts with the manifest's claim of 'pure research' and no trading signals/monitoring, creating a deceptive scope mismatch that can enable downstream investment recommendations.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger conditions are broad enough to activate on ordinary discussion of investing, planning, or policy topics, which can cause the skill to run data-collection and networked research flows when the user did not intend that level of action. In this skill's context, over-triggering is more dangerous because activation may disclose sensitive research topics to third-party providers and write local artifacts automatically.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The template hard-codes Chinese-only instructions and output format across the entire prompt, without allowing the caller or downstream user to choose language. In a general-purpose research skill, this can cause policy analysis to be generated in an unintended language, degrading usability, reviewability, and potentially causing misunderstanding in multilingual workflows or automated pipelines that expect another language.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: These instructions direct the agent to fetch arbitrary external URLs and perform searches without any consent, allowlist, or warning that queries and targets will be sent to third parties. That creates data-exposure and SSRF-style risk in agent environments, especially if search results or user-provided topics can influence which URLs are fetched.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs use of multiple external APIs, search providers, and social platforms without warning about privacy, reliability, or data-sharing implications. In an agent setting, this can leak research topics, watchlists, or user-sensitive context to third parties and increase exposure to untrusted content sources.

VirusTotal

60/60 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.