TradingView技术指标分析助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:03 AM UTC
• Version: 1.0.6

Overview

The skill is mostly disclosed, but it asks for persistent remote-service credentials and includes broader financial/history access than its TradingView indicator purpose clearly justifies.

Review before installing. Only use this skill if you are comfortable sending financial-analysis prompts to Prana, storing a persistent Prana API key in OpenClaw, and exposing a browser-openable skill history link. Avoid sending personal, account, brokerage, or credential data through the skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: 文件整体以中文命名和指令示例为中心，示例请求也仅给出中文表达，未说明是否支持其他语言或允许用户选择输出语言。按照语言/区域政策，若技能默认或隐含强制特定语言而没有用户选择机制，属于自然语言策略风险。

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: L018-L019 将触发条件描述为“当客户描述需要使用查询TradingView 技术指标相关的分析与计算结果时”并给出“帮我分析…”这类日常表达示例，但没有限定明确触发短语、边界或排除条件。这类表述容易与普通聊天中的泛化分析请求重叠，导致技能被意外调用。

External Transmission

Medium

• Category: Data Exfiltration

Content

接口调用命令：

```bash
curl -sS "https://www.prana.chat/api/v2/api-keys"
```

接口正常响应示例：

• Confidence: 97% confidence
• Finding: The skill retrieves an API key from a remote endpoint without authentication and instructs storing it as a global persistent environment variable, then uses it for subsequent remote agent calls. This creates a serious trust-boundary problem: a remotely supplied credential is persisted locally and may grant ongoing access beyond the immediate user action, while the document itself admits the endpoint is unauthenticated and effectively auto-creates a user/token relationship.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill claims to perform TradingView technical-indicator analysis, but it also exposes a function to retrieve a browser-openable purchase/history URL unrelated to that purpose. This expands the skill's effective data-access scope beyond user-expected analysis behavior and can leak account-linked activity metadata or facilitate unauthorized viewing of transaction/history records.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Access to skill purchase/history records is not justified by the stated business purpose of technical indicator analysis. When a skill can retrieve account-related history artifacts without tight scoping, it creates unnecessary exposure of sensitive usage records and increases the chance of privacy violations or confused-deputy behavior.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill claims to perform TradingView technical-indicator analysis, but it also declares access to a purchase-history URL endpoint unrelated to that purpose. This expands the data-access surface beyond user-expected functionality and could expose account or commercial metadata without a clear need, violating least-privilege expectations.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The usage examples broaden the skill from technical-indicator analysis to general stock returns, price movement, and financial-report retrieval, which does not match the declared scope. This mismatch can cause over-triggering and lead users or orchestrators to send broader financial queries and data to a remote agent than intended.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: Broad usage examples create an ambiguous activation scope, making the skill eligible for general stock and financial-report requests rather than only technical-indicator analysis. In agent ecosystems, this can route unrelated or sensitive finance queries to an external service unexpectedly, increasing data exposure and misuse risk.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: Natural-language policy review applies to all file types. The visible skill name and description are entirely in Chinese, and the usage examples are also Chinese-only, with no indication that users may choose another language or that the locale restriction is intentional and justified. This can conflict with organizational language-choice policies when skills are expected to avoid forcing a language without opt-in.

Static analysis

No suspicious patterns detected.