独孤九剑

• Outcome: Pass
• Latest audit: Jul 24, 2026 · 4:39 PM UTC
• Version: 1.0.2

Overview

This skill is a disclosed A-share stock analysis tool that fetches market data, computes indicators, and can generate charts, with no evidence of hidden persistence, credential access, destructive behavior, or exfiltration.

Install this only if you are comfortable with the skill making outbound requests to public market-data providers and possibly news sources for stock analysis. Treat the generated trading suggestions as informational, not as investment advice. For stricter environments, pin dependencies and review provider terms before enabling the MCP server.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill explicitly instructs the agent to fetch stock and news data from multiple external providers, but no permissions or user-facing authorization model is declared. This creates an implicit network-capable skill that can transmit user-supplied inputs and trigger outbound requests without transparent consent, which is a real security and privacy issue even if the business purpose is legitimate.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose is stock analysis, but the skill also exposes extra MCP tools, performs knowledge retrieval unrelated to a requested stock, writes PNG files to disk, and relies on multiple external services not surfaced in the description/permissions. This mismatch increases attack surface and weakens user trust because consumers may invoke a seemingly narrow skill that actually has broader filesystem, tool-exposure, and network behavior.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The file explicitly implements anti-blocking and anti-rate-limit evasion behaviors such as random delays, User-Agent rotation, and multi-source fallback to keep scraping third-party market data available. In an agent skill context, this goes beyond ordinary data fetching and can facilitate bypassing provider controls or terms-of-service restrictions, increasing legal, operational, and abuse risk.

Context-Inappropriate Capability

Low

• Confidence: 79% confidence
• Finding: The health-check routine actively probes several external providers using a hardcoded stock code outside a direct user analysis request. In an agent environment this expands external network activity and can create unintended background traffic, provider fingerprinting exposure, or policy violations if invoked automatically or repeatedly.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The markdown promises automatic external data fetching and even suggests possible news searching, but provides no clear privacy, network, or third-party disclosure to the user. This is dangerous because user prompts may be enriched or relayed to outside services unexpectedly, creating data leakage and consent risks in environments where network use is sensitive.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

akshare>=1.12.0
pandas>=1.5.0
numpy>=1.24.0
mplfinance>=0.12.10

• Confidence: 94% confidence
• Finding: The dependency is specified with only a lower bound, which allows installation of any newer version. This weakens build reproducibility and can unexpectedly pull in breaking changes or newly introduced malicious/compromised releases from the supply chain.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

akshare>=1.12.0
pandas>=1.5.0
numpy>=1.24.0
mplfinance>=0.12.10
matplotlib>=3.7.0

• Confidence: 94% confidence
• Finding: Using a minimum-version specifier instead of an exact pin permits uncontrolled upgrades during installation. In a package-fetching skill, this creates avoidable supply-chain and reproducibility risk because different environments may resolve to different package versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

akshare>=1.12.0
pandas>=1.5.0
numpy>=1.24.0
mplfinance>=0.12.10
matplotlib>=3.7.0
requests>=2.28.0

• Confidence: 94% confidence
• Finding: An unpinned numeric library can resolve to varying versions over time, reducing reproducibility and increasing exposure to accidental insecure or incompatible releases. While not an immediate exploit by itself, it is a genuine supply-chain hardening weakness.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

akshare>=1.12.0
pandas>=1.5.0
numpy>=1.24.0
mplfinance>=0.12.10
matplotlib>=3.7.0
requests>=2.28.0

• Confidence: 94% confidence
• Finding: The package version is not fixed, so installs are not deterministic and may consume future releases without review. That creates a low-severity supply-chain exposure and makes secure builds harder to audit and reproduce.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas>=1.5.0
numpy>=1.24.0
mplfinance>=0.12.10
matplotlib>=3.7.0
requests>=2.28.0

• Confidence: 94% confidence
• Finding: A lower-bound-only requirement allows dependency drift and may silently introduce insecure or incompatible versions. This is especially relevant for automated skills that may be deployed repeatedly across environments.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy>=1.24.0
mplfinance>=0.12.10
matplotlib>=3.7.0
requests>=2.28.0

• Confidence: 96% confidence
• Finding: The requests dependency is unpinned, which allows the resolver to select different versions across installs. Because this package is network-facing and has recent security advisories, leaving it unpinned increases the chance of deploying a vulnerable or otherwise unreviewed release.

Static analysis

No suspicious patterns detected.