Security audit

AkShare Stock Data Pro

Security checks across malware telemetry and agentic risk

Overview

This is a coherent, read-only stock market data helper; its broad scope and Chinese-only documentation are usability notes rather than security concerns.

Install this if you want an agent to fetch stock market data through AkShare. Be aware it may contact external market-data sources and may return large CSV datasets. Do not paste browser cookies, account sessions, or API tokens into chat; treat outputs as market data, not investment advice.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill description is very broad, covering many stock-data retrieval and analysis use cases without clear activation constraints. In an agent setting, this can cause over-triggering and unnecessary invocation of code execution paths (`exec`-based Python scripts), increasing the chance of unintended actions, data exfiltration from the runtime, or misuse when a narrower tool would suffice.

Natural-Language Policy Violations

Medium

Confidence: 80% confidence
Finding: The description is written as Chinese-only and implicitly constrains the interaction language without stating that it should follow the user's preferred language. This can cause the agent to ignore user intent or system language policy, leading to confusing outputs, degraded trust, and policy bypass in multilingual environments.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.