Security audit

🦆 投研鸭 · 二级市场每日策略简报

Security checks for vulnerabilities and agentic risk

Overview

This skill only fetches disclosed market-briefing data from its own API domain and does not install code, persist, or request credentials.

Install this if you are comfortable with market-related prompts potentially causing outbound requests to api.touyanduck.com. Treat the briefing as informational market commentary rather than financial advice, and invoke the skill explicitly when you want tighter control over when it runs.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger list is overly broad and includes generic market-related phrases such as '今天市场怎么样', '市场分析', and 'daily briefing', which can cause the skill to activate in many ordinary finance conversations without clear user intent. This increases the chance of unprompted routing to an external data-fetching workflow and may override user expectations about which tool or source is being used.

Static analysis

No suspicious patterns detected.