实时财经数据

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:33 PM UTC
• Version:
  1.0.0

Overview

This is a straightforward finance quote skill that sends market lookup requests to Sina Finance and Yahoo Finance, with no evidence of hidden access, persistence, credentials use, or destructive behavior.

Install only if you are comfortable with finance-related queries being sent to Sina Finance and Yahoo Finance. Consider narrowing the trigger phrases if accidental activation would be a problem, and prefer HTTPS for the Sina request if the provider supports it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Several triggers are broad, common finance-related words such as “实时”, “指数”, “黄金”, and “原油”, which can appear in ordinary conversation and cause the skill to activate unintentionally. Unintended invocation is risky here because activation leads to code execution and external network requests, potentially leaking user queries to third-party data sources without clear intent.

VirusTotal

65/65 vendors flagged this skill as clean.