Nio Enhanced Analysis

• Outcome: Review
• Latest audit: May 29, 2026, 9:32 PM
• Version:
  1.0.0

Overview

This skill looks like a local NIO stock-analysis helper, but it presents simulated market data as real analysis that could mislead investment decisions.

Review this carefully before installing. Treat it as a demo or toy report generator, not a source of live market intelligence. Do not rely on its prices, news, sentiment, target prices, stop losses, or trading recommendations unless the publisher replaces the mock data with verified live sources and clearly labels data provenance.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Description-Behavior Mismatch

Medium

• Confidence: 99% confidence
• Finding: The skill presents itself as enhanced real-time stock analysis, but the implementation fabricates prices, sentiment, and news-derived conclusions using static values and randomness. In a financial-analysis context, deceptive synthetic data can mislead users into making trading decisions on false premises, which is a security/trust issue even without classic code-execution behavior.

Description-Behavior Mismatch

Low

• Confidence: 91% confidence
• Finding: The script writes analysis reports to local JSON files without the skill description disclosing that side effect. Undocumented file creation can surprise users, leak sensitive investment-related activity to disk, and violate least-surprise expectations for a skill that appears to only display analysis.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The docstrings claim real-time price/news retrieval, but the implementation uses simulated data. This mismatch increases the likelihood that downstream users or agents will trust fabricated results as live market intelligence, amplifying the risk of harmful financial decisions.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: The market sentiment function implies it is obtaining actual market sentiment analysis, but it returns hardcoded and randomized placeholder values. In this skill's investment-advice context, fabricated analyst ratings and institutional activity materially distort the basis for recommendations.

VirusTotal

62/62 vendors flagged this skill as clean.