T09 · Insecure Skill Coding Practices
Note
- Location
scripts/analyser.py:123- Finding
Market Data Retrieved over Unencrypted HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
Jarvis Stock Monitor
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed stock, ETF, and gold monitoring skill with a user-started background monitor; it has privacy, localization, and robustness caveats but no evidence of hidden exfiltration, destructive behavior, or privilege escalation.
Install only if you are comfortable with a Chinese/China-market stock monitor that stores portfolio details locally and sends watched symbols or names to external market-data services. Start the daemon only when you want continuous monitoring, stop it when finished, protect any config.py or notification credentials from sharing or version control, and treat generated trading suggestions as informational rather than financial advice.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/control.sh:23- Finding
Unvalidated PID File Can Cause Termination of an Unrelated Process
- Content
View full analysis
/dev/null; then echo "🛑 停止监控进程 (PID: $PID)..." kill "$PID" rm "$PID_FILE" echo "✅ 已停止" else echo "⚠️ 进程不存在" rm "$PID_FILE" fi else ``` Related PID-file use also occurs in the start and status paths: ```bash if [ -f "$PID_FILE" ] && kill -0 $(cat "$PID_FILE") 2>/dev/null; then ``` ### Technical Analysis The controller treats the contents of `~/.stock_monitor/monitor.pid` as authoritative. Before sending `SIGTERM`, it only verifies that a process with that numeric PID exists. It does not verify that the process is the expected Python interpreter running `monitor_daemon.py`. A stale PID file can become dangerous after PID reuse: if the monitor exits without removing its PID file and the operating system later assigns that PID to another process owned by the same user, `control.sh stop` will terminate the unrelated process. A modified PID file creates the same condition. In the normal deployment, the directory is located under the current user's home directory, so this does not create a privilege escalation: another account would ordinarily need pre-existing permission to modify the file. The primary concern is accidental same-user denial of service and unsafe process lifecycle management. The unquoted command substitution in the start and status checks also lacks strict numeric validation. Although shell metacharacters emitted by command substitution are not reparsed as shell syntax, malformed content can still produce incorrect arguments and unreliable behavior. ### Attack Path 1. The monitor starts and writes its process ID to `~/.stock_monitor/monitor.pi ...[truncated 865 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The documented skill promises a production-grade monitoring system with seven alert rules and paid advanced features, but the observed code behavior reportedly centers on tests and only evidences a subset of alerts. This is dangerous because users may install or pay for a skill whose actual behavior differs materially from its stated operational and billing model, creating integrity and trust issues in a financial context.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The documented skill promises a production-grade monitoring system with seven alert rules and paid advanced features, but the observed code behavior reportedly centers on tests and only evidences a subset of alerts. This is dangerous because users may install or pay for a skill whose actual behavior differs materially from its stated operational and billing model, creating integrity and trust issues in a financial context.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 87% confidence
- Finding
The documented skill promises a production-grade monitoring system with seven alert rules and paid advanced features, but the observed code behavior reportedly centers on tests and only evidences a subset of alerts. This is dangerous because users may install or pay for a skill whose actual behavior differs materially from its stated operational and billing model, creating integrity and trust issues in a financial context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README consistently presents the skill in Chinese, including headings, setup guidance, alerts, and disclaimer text, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless a locale-specific justification is clearly documented.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 71% confidence
- Finding
The skill advertises behavior that depends on external market data and AI-assisted analysis, yet the manifest documentation provides no explicit tool scope such as allowed network access. Missing scope declarations reduce transparency and make it harder for users or platforms to understand what external communication the skill may perform, which is especially relevant in a finance-related skill that may transmit portfolio context or query third-party services.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The documentation instructs users to store holdings and cost basis locally in configuration files without any privacy or security warning. Portfolio composition and entry prices are sensitive financial data; if stored in plaintext in a predictable path, they may be exposed to other local users, backups, logs, or accidental publication.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The section header explicitly states monitoring frequency in Beijing time, and the schedule is presented as the default operating model. This creates a locale-specific constraint in natural-language documentation without indicating that users can switch timezones or opt into a different locale.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description is entirely in Chinese, which indicates the skill is presented in a single language without any visible option for users to choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest describes a stock monitoring and alerting system centered on seven specific warning rules such as cost percentage, moving-average crosses, RSI, volume anomalies, gap detection, and dynamic take-profit. This file’s module docstring and implemented methods add materially different capabilities—news scraping, sentiment analysis, fund-flow retrieval, 龙虎榜 data access, and gold-price correlation analysis—which go beyond those declared alert functions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module title and descriptive docstrings are written entirely in Chinese, and the generated user-facing analysis/report text is also hard-coded in Chinese throughout the file. This creates a language/locale constraint without any opt-in or alternative language path, which violates the policy for skills that force a specific language.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest presents the skill as a monitoring and warning system, but this code synthesizes data into a 'deep analysis' report and produces action-oriented suggestions such as waiting, buying dips, or trend-following. That is a broader advisory behavior than straightforward alerting based on predefined rules.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh echo "🚀 启动 Stock Monitor 后台进程..." mkdir -p "$LOG_DIR" nohup python3 "$SCRIPT_DIR/monitor_daemon.py" > "$LOG_DIR/monitor.log" 2>&1 & echo $! > "$PID_FILE" echo "✅ 已启动 (PID: $!)" echo "📋 日志: $LOG_DIR/monitor.log"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file includes user-facing descriptions and messages in Chinese only, including the module docstring and later alert text, but does not indicate that the skill is restricted to Chinese-speaking users or provide any opt-in for language preference. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a 'full-featured' stock monitoring system supporting 7 major alert rules including gap detection and dynamic trailing stops. While several rules are implemented elsewhere, there is no complete end-user feature coverage for broader 'Pro' intelligence implied by the description, and this file includes a news-fetching capability that does not actually provide news content, returning only a placeholder string after making a network call.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The monitor includes extra outbound network access to a company-survey/news endpoint that is not necessary for core price alerting and is currently stubbed. Unnecessary external requests enlarge the attack surface, may leak usage patterns or watched symbols to third parties, and create an avoidable dependency that could later be repurposed unsafely in an agent context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This Python file is entirely described through Chinese-language docstrings and user-facing output, beginning with the top-level description on L003-L004. Under the policy rule, language forcing can be a violation when no language choice, opt-in, or justification is provided for the locale constraint.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The markdown instructs users to edit
scripts/config.pywith detailed position information such as security codes, names, and cost basis. This is user financial data, but the README does not warn users to protect the file, avoid committing it, or treat it as sensitive.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This Python file contains natural-language instructions entirely in Chinese, including the module docstring and operational comments. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy violation unless the restriction is clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script's comments and all user-facing status/help messages are in Chinese, including startup, stop, status, and usage output. Under the policy, forcing a specific language without user opt-in or a documented locale-specific justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module docstring and user-facing operational messages are written in Chinese, and the script does not provide any user opt-in or configurable locale selection. Under the policy for natural-language constraints, this is a locale/language choice issue because the skill implicitly forces one language for status and shutdown messaging.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The manifest describes the skill as a stock monitoring and alerting system, but this test file explicitly validates a '伦敦金API' and checks handling of a gold asset code ('XAU'). That indicates the implemented scope extends beyond stocks into precious-metals monitoring, which is broader than the stated description.
- Content
Static analysis
No suspicious patterns detected.