chanlun-engine-skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:23 AM UTC
• Version: 1.1.8

Overview

This is mostly a coherent stock-analysis skill, but it tells the agent to accept API keys in chat and store them using an unsafe shell command.

Review before installing. The stock-analysis functionality appears legitimate, but do not paste API keys into chat for this skill. If using the optional HITHINK data source, enter the key locally with `python scripts/setup_env.py --set-key`, prefer an isolated virtual environment, and be aware that non-Windows systems store the key as a mode-600 plaintext file.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:46

Finding

Agent instructions require unsafe collection and persistence of credentials received through chat

Content

View full analysis

| python scripts/setup_env.py --set-key`（stdin 直入，加密落盘，key 不写进任何脚本参数或临时文件），确认成功后回一句：已加密存进本机（Windows 走系统级 DPAPI），聊天里那条消息可以删掉，不放心随时去 fuyao.aicubes.cn/admin 作废重签。介意隐私的用户才引导终端自录（getpass 不回显） ``` Translated security-relevant instructions include: immediately store any key sent through chat, do not refuse, and run a generated shell command containing that key. ### Technical Analysis The Skill explicitly directs the Agent to suppress refusal or caution when a user supplies a credential through chat. It then requires the Agent to copy that credential into a tool invocation and persist it locally. This behavior overrides safer credential-handling boundaries when the Skill is loaded. It also directly conflicts with `SECURITY.md:9`, which states that credentials must be entered locally through `getpass`, must not pass through AI conversation records, and must not be transmitted through chat. Even when the credential is passed to the script through standard input, it has already entered several potentially retained contexts: - The conversation history - Agent execution context - Tool invocation or shell-command logs - Platform telemetry and audit logs - Local credential storage The persistence behavior is not necessary for the core local Chan-theory computation. Optional authenticated market-data access can be configured through a user-controlled interactive terminal without exposing the credential to the Agent. ### Attack Path 1. The Skill is loaded and its instructions become active in the Agent session. 2. A user or attacker submits a purported HiThink API key in the conversation. 3. The Skill directs the Agent not to refuse or warn against chat-based credential submission. ...[truncated 1005 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:46

Finding

Unquoted chat-controlled API key can inject shell commands

Content

View full analysis

| python scripts/setup_env.py --set-key`（stdin 直入，加密落盘，key 不写进任何脚本参数或临时文件），确认成功后回一句：已加密存进本机（Windows 走系统级 DPAPI），聊天里那条消息可以删掉，不放心随时去 fuyao.aicubes.cn/admin 作废重签。介意隐私的用户才引导终端自录（getpass 不回显） ``` The vulnerable command template is: ```bash echo | python scripts/setup_env.py --set-key ``` ### Technical Analysis The Skill instructs the Agent to interpolate an attacker-controlled chat value directly into a shell command without quoting or escaping it. Shell metacharacters are interpreted by the shell before `setup_env.py` receives or validates its standard input. The script's validation does not prevent exploitation: ```python if not key.startswith("sk-"): print(json.dumps({"error": "格式不像有效钥匙(应以 sk- 开头), 未保存"}, ensure_ascii=False)) sys.exit(1) ``` This check occurs only after shell parsing. Command separators, substitutions, pipelines, and redirections can therefore execute before the Python process examines the resulting input. An input conceptually shaped like the following can cause an additional command to run: ```text sk-placeholder; attacker-command; echo sk-valid ``` When inserted into the prescribed command template, the shell processes the separators and executes `attacker-command`. The final `echo` can still provide apparently valid input to `setup_env.py`. ### Attack Path 1. An attacker submits a crafted purported API key containing shell syntax through chat. 2. The Skill requires the Agent to substitute the value into: ```bash echo | python scripts/setup_env.py --set-key ``` 3. The Agent invokes the generated command through a shell. 4. The shell interprets the embedded separators, substitutions, or redirections. 5. The injected command executes with the same operating-sys ...[truncated 842 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/setup_env.py:25

Finding

Runtime installation uses mutable dependencies without cryptographic hash verification

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This code chunk’s primary behavior is calculating Bollinger Band metrics over a rolling window. That is materially different from the declared purpose of deterministic Chan theory analysis and trade-state assessment. While a Bollinger indicator could theoretically be a supporting technical-analysis component, the provided chunk does not show any Chan-specific logic, signal interpretation, market-data integration, or four-state decision output described in the declaration. Therefore, based on this chunk alone, the description does not accurately represent what the code actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

声明的核心用途是“缠论客观分析A股股票”，重点在缠论结构识别和交易状态输出。但提供的代码文件是 Demark.py，类名和逻辑均明确对应 DeMark/TD Sequential：包含 setup、countdown、TDST_peak、9计数、13倒计数等典型规则。这与缠论的分型、笔、线段、中枢、背驰等分析体系明显不同。虽然两者都属于K线技术分析范畴，但这里不是单纯实现细节差异，而是核心分析方法发生了替换，属于主要目的不一致。代码也没有给出四态交易结论或失效价位。因此应判定描述与实际代码行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This code chunk’s primary behavior is RSI calculation, which is a different technical-analysis method from the declared Chan-theory structural engine. While RSI could be a supporting indicator in a broader trading system, the declared description is specifically about deterministic Chan structure computation and four-state action judgments. In this snippet there is no Chanlun-specific logic, no stock decision outputs, and no invalidation price handling. Therefore, the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明的核心能力是对股票进行缠论分析并给出操作判断，但提供的代码片段只是一个测试数据生成脚本。它使用随机数和简单价格演化逻辑创建CSV文件，不处理用户输入、不分析任何股票、不调用免费数据源，也不计算分型、笔、线段、中枢、背驰或买卖点。因此该代码的实际用途与声明的主要目的明显不一致，属于实质性描述不符。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a user-facing analysis skill for interpreting Chan-theory structure on a mentioned A-share stock and returning a four-state action recommendation with invalidation price. The supplied code instead implements scan_market.py, whose primary purpose is whole-market scanning: it loads all symbols from DuckDB, filters ST/newly listed/suspended names, parallelizes per-symbol Chan engine runs, collects symbols with fresh recent buy/sell points, ranks candidates, and writes a market-wide JSON screener report. This is materially different from a per-stock decision assistant. Some overlap exists—both involve Chan-theory structural computation and invalidation-related outputs—but the main behavior here is a universe scan / candidate funnel, not the described single-stock recommendation workflow. Therefore this is a meaningful description-behavior mismatch.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly directs the agent to collect API credentials in chat and immediately store them. Collecting secrets through normal conversation is dangerous because chat channels are often logged, retained, or visible to systems beyond the user's immediate intent, and the instruction normalizes secret exfiltration into the conversational path.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The code accesses a local credentials file and is capable of extracting a usable API key from it, including decrypting a DPAPI-protected value. While it does not exfiltrate the secret elsewhere beyond intended API use, this is still credential access behavior that can violate user expectations and increases the blast radius if the skill is repurposed or modified.

Content

Scanner excerpt · scripts/get_data.py (reported line 33)May include surrounding context.

python

if k:
        return k
    base = os.environ.get("APPDATA") or os.path.expanduser("~/.config")
    p = os.path.join(base, "hithink-finance", "credentials.env")
    if os.path.exists(p):
        for line in open(p, encoding="utf-8"):
            if line.startswith("HITHINK_FINANCE_API_KEY_DPAPI="):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The script defines a credentials file path and later stores an API key there, using plaintext on non-Windows systems. Local secret storage is inherently sensitive; if the host is multi-user, backed up insecurely, or the file is read by other software, the credential can be exposed and abused.

Content

Scanner excerpt · scripts/setup_env.py (reported line 44)May include surrounding context.

python

def cred_path():
    base = os.environ.get("APPDATA") or os.path.expanduser("~/.config")
    return os.path.join(base, "hithink-finance", "credentials.env")


def _dpapi_protect(data):

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run npx skills add adsorgcn/chanlun-engine-skill without pinning a specific version or commit, which can cause different code to be fetched over time. If the upstream package, installer, or referenced repository is compromised or updated maliciously, users may execute unreviewed code during installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares substantial capabilities through its instructions and example commands (shell execution, environment access, file reads/writes, optional networked data retrieval) but does not constrain them with an explicit tool/permission scope. That increases the chance an agent will overuse available tools or perform sensitive actions not clearly authorized by the manifest, especially since the document also includes setup and secret-handling steps.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file presents the skill name, description, and operating instructions entirely in Chinese and instructs the model to explain using specific Chinese phrasing to users. There is no indication that users may choose another language or locale, which can violate language-choice policy absent explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation description says to use the skill when the user wants to know whether a stock should be bought, sold, held, or waited on. That phrasing overlaps with very common everyday finance questions and does not clearly bound when this specialized 缠论 skill should activate versus other stock-analysis skills.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation instructs the agent to persist a user-provided API key locally, which goes beyond the advertised role of merely interpreting deterministic analysis output. Secret storage is a sensitive capability because it changes the system state, may retain credentials longer than the user expects, and creates risk of accidental disclosure, misuse, or insecure local handling.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Telling the agent to accept an API key in chat and store it creates a clear secret-handling risk. Even if the downstream storage is encrypted, the secret has already been exposed in the conversation transcript and may be retained in logs or mishandled by surrounding systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This troubleshooting file presents all user-facing instructions exclusively in Chinese, which can amount to a language/locale policy violation when no user opt-in or alternative language path is provided. The file does not indicate that the skill is region-specific or that Chinese is an intentional, documented requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire notice is written only in Chinese, with no indication that other languages are supported or that the language restriction is intentional and justified. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown skill reference forces a specific language/locale for all users through its natural-language content. Under the policy, locale restrictions should either be optional for the user or explicitly documented as justified for a region-specific purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The guide explicitly instructs users to paste an API key into the AI chat, which exposes a credential to the assistant and potentially to chat logs, telemetry, sync history, or other retention systems outside the user's local machine. Although the document says the key is stored encrypted locally and can be revoked, it does not clearly warn that sending secrets through chat may disclose them to the AI platform before local storage occurs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code unconditionally reconfigures stdout to UTF-8 and the inline comment states it is being fixed to UTF-8. This is a natural-language locale policy concern because the skill enforces a specific output encoding/locale behavior without user opt-in or an offered alternative.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · engine/chanpy/BuySellPoint/BSPointList.py (reported line 402)May include surrounding context.

python

bsps = [{
        "d": _t(p.klu.time), "bs": "B" if p.is_buy else "S", "type": p.type2str(),
        "px": round(p.klu.close, 3), "sure": bool(p.bi.is_sure),
    } for p in kl_list.bs_point_lst.getSortedBspList()[-tail_bsp:]]

    pos = None
    if zss:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · engine/chanpy/Chan.py (reported line 307)May include surrounding context.

python

bsps = [{
        "d": _t(p.klu.time), "bs": "B" if p.is_buy else "S", "type": p.type2str(),
        "px": round(p.klu.close, 3), "sure": bool(p.bi.is_sure),
    } for p in kl_list.bs_point_lst.getSortedBspList()[-tail_bsp:]]

    pos = None
    if zss:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · engine/chanpy/Chan.py (reported line 309)May include surrounding context.

python

bsps = [{
        "d": _t(p.klu.time), "bs": "B" if p.is_buy else "S", "type": p.type2str(),
        "px": round(p.klu.close, 3), "sure": bool(p.bi.is_sure),
    } for p in kl_list.bs_point_lst.getSortedBspList()[-tail_bsp:]]

    pos = None
    if zss:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/chan_engine.py (reported line 152)May include surrounding context.

python

bsps = [{
        "d": _t(p.klu.time), "bs": "B" if p.is_buy else "S", "type": p.type2str(),
        "px": round(p.klu.close, 3), "sure": bool(p.bi.is_sure),
    } for p in kl_list.bs_point_lst.getSortedBspList()[-tail_bsp:]]

    pos = None
    if zss:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The module docstring, usage guidance, and user-facing error/help strings are written exclusively in Chinese, which imposes a language choice on users without opt-in. Under the policy, forcing a specific language without offering alternatives is a natural-language policy violation unless clearly justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script automatically reads API credentials from environment variables and a local credentials file, and can decrypt a DPAPI-protected key without any explicit user opt-in in the execution path. In the context of a skill advertised as usable out-of-the-box without registration, silently harvesting previously stored credentials expands trust boundaries and may cause unintended use of a user's existing account and secrets.

Content

No source excerpt is available for this finding.