A Share Risk Alert

Security checks across malware telemetry and agentic risk

Overview

This appears to be a stock-risk analysis skill with an overly broad trigger phrase list, but no evidence of hidden access, persistence, destructive behavior, or data exfiltration.

Installers should treat this as benign but verify that financial-risk prompts include a stock, ticker, or company context before relying on the output. The publisher should narrow activation phrases or add disambiguation so generic safety questions do not trigger investment-style analysis.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger list is broad and includes generic phrases such as “有没有风险”, “风险排查”, and especially “XX安全吗”, which can overlap with ordinary conversation and cause the skill to activate outside its intended stock-analysis context. In a finance skill, misrouting can lead to irrelevant or misleading risk assessments being presented as authoritative investment analysis, increasing user confusion and the chance of unsafe financial guidance.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal