Precise T Trading

Security checks across malware telemetry and agentic risk

Overview

This is not malware, but it gives actionable trading guidance from simulated and hard-coded inputs, so users should review it carefully before relying on it.

Install only if you treat this as educational or paper-trading support. Before using it with real money, replace mock and hard-coded data with verified market and trade-history data, review the hard-coded log location, avoid running it as administrator, and independently verify every recommendation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The code injects a remote <script> from qt.gtimg.cn and trusts the callback payload as quote data, but JSONP is executable JavaScript from a third party. If that endpoint is compromised, returns unexpected code, or is tampered with in transit via another trusted component, arbitrary script executes in the page origin and can modify the DOM, exfiltrate data, or abuse any available browser/session context.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The final trading plan presents live-looking buy/sell ranges but uses a hard-coded current price of 4.06 instead of the fetched real-time quote. In a trading skill, this can mislead users into acting on stale or fabricated decision thresholds, undermining risk controls and causing avoidable financial loss.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This publication guide markets a quantitative intraday trading skill, highlights expected downloads and monetization, and references收益案例/实际收益 without any prominent disclaimer about financial risk, losses, model limitations, or that the tool is not investment advice. In the context of an active trading skill for volatile Chinese A-shares, omission of risk warnings can mislead users into overtrusting the system and taking risky financial actions based on promotional framing.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: Overly broad trigger conditions can cause the agent to activate the skill for loosely related user requests, potentially initiating trading analysis or monitoring workflows when the user did not clearly request them. In this context, accidental activation is more serious because the skill can perform network access and filesystem writes and may present authoritative-seeming financial recommendations.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The example trigger '打开监控面板' is generic enough to collide with unrelated requests to open a dashboard or panel, which could route users into this skill unintentionally. Because the skill is finance-oriented and can influence trading decisions, ambiguous routing increases the risk of misapplication and user confusion.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal