A Share Multifactor Model

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:32 PM UTC
• Version:
  1.0.0

Overview

This is a straightforward A-share factor-model analysis skill with no evidence of hidden data access, credential use, persistence, or destructive behavior.

Install this if you want A-share multifactor or Barra-style analysis. Before using it, confirm the task is really about A-share factor modeling, review the separate cn-stock-data dependency and its data sources, and treat the output as quantitative analysis rather than financial advice or an instruction to trade.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger description contains very broad phrases such as "多因子", "multifactor", "Barra", and generic requests like "风险模型", which can match many ordinary finance queries and cause the skill to activate unintentionally. Over-broad activation increases the chance that the wrong toolchain is invoked, leading to irrelevant data access, confusing outputs, and unsafe delegation behavior in multi-skill environments.

VirusTotal

60/60 vendors flagged this skill as clean.