独孤九剑V2

• Outcome: Pass
• Latest audit: Jul 24, 2026 · 5:39 PM UTC
• Version: 1.0.1

Overview

This skill is a disclosed stock-analysis tool that fetches public market data and generates analysis/charts, with some compliance and dependency caveats users should review.

Install only if you are comfortable with the skill contacting third-party market-data providers using the stock codes you ask about and writing generated chart PNGs locally. Use current patched Python packages, review the data-provider terms, and treat the output as analysis support rather than financial advice.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill clearly instructs the agent to execute Python scripts that fetch stock and market data from external providers, but no corresponding permission declaration is present. This creates an authorization and transparency gap: users and hosts may not realize the skill can make outbound network requests, which can lead to unreviewed data exfiltration or policy bypass in environments that rely on declared permissions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The declared purpose frames the skill as stock analysis, but the actual behavior includes additional MCP tools, health checks, external network retrieval from multiple providers, and writing PNG files to disk. This mismatch is dangerous because reviewers and users may grant trust based on a narrower description while the skill exposes broader capabilities that expand attack surface and data-handling behavior.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The file explicitly advertises '防御层: 随机延迟、UA轮换、数据源健康检查' and frames the design around avoiding provider blocking ('不触发封控', '多源容灾'). In a stock-analysis skill, implementing anti-blocking/evasion behavior against third-party data providers is risky because it normalizes bypassing service controls and can facilitate unauthorized scraping patterns beyond ordinary user expectations.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Maintaining a rotating User-Agent pool is not necessary for normal single-user stock analysis and is commonly used to evade bot detection or request fingerprinting by upstream services. In this context, it increases the capability of the skill to conceal automation from providers and makes non-compliant scraping easier.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The randomized delays and jittered retry behavior are presented as anti-blocking controls rather than purely operational resilience. While retries themselves can be benign, coupling them with random timing to avoid detection materially increases the script's ability to persist against provider throttling or anti-abuse controls.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill description does not clearly warn that invoking stock analysis may trigger outbound requests to third-party data sources and optional news searching. This reduces informed user consent and can surprise operators in restricted environments, especially where external lookups are sensitive or disallowed.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The code performs outbound HTTP requests to Sina/Tencent endpoints to retrieve live market data, but there is no user-facing disclosure or consent flow indicating that external network access will occur. In an agent skill, undisclosed network activity can expose user queries and create privacy, compliance, and trust issues even if the business purpose is legitimate.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The health-check routine actively contacts multiple third-party providers when invoked, again without a user-facing warning. Because this can trigger real network traffic across several domains and may run during startup or diagnostics, it broadens external exposure and can surprise users or operators who expect a local-only analysis tool.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy>=1.24.0
mplfinance>=0.12.10
matplotlib>=3.7.0
requests>=2.28.0

• Confidence: 84% confidence
• Finding: requests>=2.28.0

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: requests==2.28.0

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.