Security audit

A Share Portfolio Optimize

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed A-share portfolio optimization helper with a functionality/documentation gap, but no evidence of hidden access, persistence, exfiltration, or unsafe automatic actions.

Review the financial assumptions before relying on the output: the skill produces allocation suggestions from historical data and should not be treated as investment advice. Also note that the advertised Black-Litterman workflow is not fully exposed by the current CLI.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest description says the skill supports "Black-Litterman", and the code even defines an optimize_black_litterman function. However, the command-line interface restricts --method to min_var, max_sharpe, risk_parity, equal_weight, and all, and the main execution loop never invokes the Black-Litterman path. This is a clear mismatch between claimed capability and actual reachable behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The description says the skill triggers on phrases such as "组合优化", "怎么分配权重", and related terms, but it does not define context boundaries or negative examples. Some of these phrases could plausibly appear in general investing discussion without the user intending to invoke this specific skill, making activation criteria less precise.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The natural-language description is written entirely for A-share analysis in Chinese and offers style choices, but does not state that the user may choose the response language or locale. Under the policy, language or locale constraints should be optional or explicitly justified with user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The document title and all instructional content are written entirely in Chinese, which imposes a specific language on users without offering an opt-in or alternative language. The policy allows locale-specific constraints only when they are clearly documented and justified; this file is A-share specific, but it does not explicitly state that Chinese is required or provide language choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code file contains natural-language strings for the module description and usage instructions entirely in Chinese, with no alternative language option or opt-in. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale limitation is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The argparse description and argument help strings are all presented in Chinese, which constrains user interaction to one language. The file does not offer a language choice or explain why the locale restriction is required.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.