超级股票操盘 Skill

• Outcome: Review
• Latest audit: Jul 4, 2026 · 10:24 AM UTC
• Version: 1.0.0

Overview

This stock-trading skill is not malicious, but it has high-impact installation and trading-execution ambiguity that users should review before installing.

Install only if you are comfortable with a finance skill that can guide trading decisions and, if you run its installer, can add many third-party skills and dependencies to your local agent environment. Do not run the installer without reviewing the listed GitHub repositories, avoid storing real API keys in config.json or shell startup files, and treat all order-routing or execution language as requiring explicit manual broker-side confirmation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises itself as a documentation-driven trading assistant, yet the analyzed behavior indicates access to environment variables, filesystem read/write, network, and shell capabilities without an explicit permissions declaration. This creates a hidden trust boundary: users may enable a seemingly advisory skill that can also modify local files, invoke commands, fetch remote content, and potentially access secrets, making supply-chain compromise or unintended host-side actions much more dangerous.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is investment analysis only, but the detected behavior includes cloning and installing many external repositories, running npx-based installers, creating a Python virtual environment, installing dependencies, and writing API keys to config files and the current shell environment. This mismatch is dangerous because it conceals extensive code execution and persistence behavior behind a benign description, exposing the host to supply-chain attacks, credential leakage, and broad filesystem modification.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The manifest claims the skill does not provide direct order placement, but the capability list explicitly includes order-routing and execution-oriented functions such as order-routing-skill and trading execution workflows. In a financial context, this contradiction is especially risky because users may rely on the disclaimer while the skill still contains mechanisms that could automate or facilitate trade execution with real monetary consequences.

Intent-Code Divergence

High

• Confidence: 92% confidence
• Finding: The documentation internally contradicts itself on whether trading actions are merely advisory or can be executed, undermining informed consent and safe deployment decisions. In a stock-trading skill, ambiguity around execution authority materially increases risk because users and platform controls may underestimate the possibility of automated trading behavior or related side effects.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The workflow explicitly includes `order-routing-skill`,委托, and execution-oriented steps during尾盘 and收盘 phases, which conflicts with the stated boundary that the skill does not provide direct order placement and that trades require manual secondary confirmation. In a trading context, this mismatch is dangerous because downstream agents may treat the workflow as authorization to place or route orders automatically, creating real financial-loss risk and control bypass.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The registry explicitly includes order-routing, batch execution, and related execution capabilities while the skill metadata claims there is no direct order channel. That mismatch can cause downstream orchestrators or users to invoke the skill for real trading actions under a false assumption of analysis-only behavior, creating a serious integrity and safety risk in a financial context.

Description-Behavior Mismatch

Low

• Confidence: 89% confidence
• Finding: The installer persists API keys into config.json on disk for a stock-analysis skill, which expands the skill's scope into credential handling. Storing secrets in a general project config file increases the chance of accidental disclosure via local file exposure, backups, or source control, especially since the script does not enforce restrictive permissions or obtain explicit consent for disk storage.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script is designed to bulk-clone 16 third-party GitHub repositories and then install their dependencies, plus invoke remote NPX-based installation. This creates a broad software supply-chain risk because many independently maintained remote codebases are pulled and trusted automatically without pinning commits, verifying signatures, or reviewing contents.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger keyword list is very broad and includes generic finance/investment phrases that can plausibly appear in normal conversation, increasing the chance of unintended skill activation. In a trading-related skill, accidental invocation is more sensitive because it can surface persuasive market guidance, portfolio analysis, or risk recommendations in contexts where the user did not explicitly request this specialized behavior.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger conditions are extremely broad, covering many common investing and market-related keywords, which can cause the skill to activate in conversations where the user did not intend to invoke a high-capability trading workflow. Because this skill appears to have powerful file, network, and shell behaviors, over-broad activation increases the chance of unintended execution, excessive data access, or confusing autonomous behavior in sensitive financial contexts.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The document describes actions with financial and state-changing consequences, including减仓/止盈/止损 and writing transaction logs, but the workflow step itself does not consistently surface an explicit warning that these actions can affect portfolio state or create losses. In a high-stakes financial skill, insufficient in-context warnings increase the chance that an orchestrator or user treats these steps as routine automation instead of sensitive actions requiring confirmation.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: Broad trigger scenarios such as generic investing tasks can cause the wrong expert skill to be invoked without sufficient user intent verification. In a finance-oriented agent, misrouting can produce inappropriate recommendations or bypass expected specialization and risk checks, which increases the chance of harmful guidance even if no code execution occurs.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: A registry-wide pattern of loosely constrained trigger scenarios creates an unsafe routing surface where many experts may activate for ambiguous prompts. In a stock-trading skill, this is more dangerous than in a general reference skill because erroneous invocation can lead to financial decision support that is irrelevant, conflicting, or insufficiently risk-controlled.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: Overly broad triggers in a large 117-skill registry increase the chance that the wrong skill is auto-selected for sensitive financial tasks. In this domain, ambiguous invocation can cascade into unsuitable analysis, unintended workflow transitions, or accidental activation of higher-risk trading functions.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: A generic trigger like 'need stock statistics and analysis' is too vague in a registry full of overlapping market, stock-picking, and research skills. This ambiguity materially raises misrouting risk, especially because the broader skill set includes execution-adjacent capabilities where incorrect selection has higher consequences.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: A broad, underspecified knowledge-base assistant trigger can become a catch-all path that absorbs unrelated requests and bypasses safer specialized routing. In an investment skill pack, that can lead to retrieval of stale, community-derived, or insufficiently governed information being used in higher-stakes decision support.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The auto-reference logic uses broad keywords such as '全球财富', '资产配置方向', and '黄金', which can be triggered during ordinary financial discussions and cause the agent to inject unrelated third-party material without strong user intent. In a trading-assistance skill, this increases the chance of scope drift, misleading authority bias, and inappropriate recommendations based on generic keyword matching rather than the user's actual request.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script writes API keys back to config.json without a prominent warning that credentials will be stored on disk. Users may enter sensitive tokens interactively expecting transient use, but the installer silently persists them, which can expose secrets through file sharing, backups, or accidental commits.

External Script Fetching

High

• Category: Supply Chain

Content

if command -v npx &>/dev/null; then
    log_ok "npx: $(npx --version 2>&1)"
  else
    log_warn "未找到 npx,Wind AIFin Market Skill 将跳过。安装: curl -fsSL https://fnm.vercel.app/install | bash"
  fi

  # clawhub(可选)

• Confidence: 91% confidence
• Finding: The script instructs users to run a curl-piped-to-bash installer from a remote URL to obtain fnm/Node tooling. Even though it is only displayed as advice, this pattern is dangerous because it encourages execution of unverified remote shell code and normalizes unsafe installation practices in an installer context.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: assets/config_template.env:10

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/install.sh:362