chanlun-engine-skill

• Outcome: Review
• Latest audit: Aug 25, 2026 · 3:40 AM UTC
• Version: 1.1.8

Overview

This stock-analysis skill mostly matches its purpose, but it gives unsafe and contradictory instructions for handling API keys.

Install only if you are comfortable with the optional API-key handling. Prefer the terminal setup path over pasting keys into chat, understand that Linux/macOS storage is a local plaintext credentials file protected by permissions, and revoke or rotate the HITHINK key if it was ever exposed in a conversation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill clearly directs the agent to use shell commands, read and write local files, access environment variables, and fetch market data over the network, yet no permissions are explicitly declared. That mismatch increases the chance of overbroad execution in hosts that rely on declared permissions for review or policy enforcement, and it obscures the real trust boundary of the skill.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill instructs the agent to persist a user-supplied API key locally from chat, which expands behavior from stock analysis into credential handling and retention. Even if intended for convenience, normalizing secret collection in conversation increases the risk of accidental disclosure, improper storage, and reuse beyond the user's expectations.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The guide makes a strong security claim that sending the API key to the AI results in immediate local, system-level encrypted storage, but this file provides no substantiation for that guarantee and explicitly instructs the user to transmit the secret through chat first. If the assistant, platform, logs, or integrations handle chat content remotely, users may be misled into exposing credentials under false assumptions about locality and confidentiality.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script automatically loads a HITHINK API key from the process environment and, if absent, searches a local credentials file and decrypts a DPAPI-protected value. That behavior expands the skill's privilege boundary beyond the advertised 'free/no registration' path and accesses local secrets without an explicit user opt-in, which is risky in an agent skill context where users may not expect credential discovery.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The script advertises free, no-registration operation yet also supports capturing and storing a third-party API key for another data source. This mismatch can mislead users about the skill’s capabilities and trust boundary, increasing the chance they provide credentials they did not expect to need.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: This code captures a third-party API key from stdin and stores it locally, which is sensitive behavior that expands the skill from analysis-only into credential management. In the context of an agent skill, adding secret intake and persistence raises the stakes because users may not expect a stock-analysis helper to request and retain credentials.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation tells users to paste an API key directly into an AI chat without a prominent warning that chat channels may not be appropriate for secrets. Even if the key is low-privilege, it is still a credential, and normal chat handling can expose it to service providers, logs, plugins, syncing, or future message review.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The instruction explicitly tells the agent to accept an API key sent in chat and immediately store it locally. This is dangerous because chat is not an appropriate secret-ingestion channel, and automatic retention trains users to disclose credentials in-band while creating opportunities for logging exposure, unauthorized local access, and persistence without meaningful informed consent.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: Encouraging users to paste a secret key into an AI conversation normalizes unsafe credential-handling behavior and increases the chance of disclosure through transcript retention or downstream processing. In this skill context, the danger is heightened because the guide is aimed at non-technical users and frames the chat path as the easiest recommended option.

Credential Access

High

• Category: Privilege Escalation

Content

if k:
        return k
    base = os.environ.get("APPDATA") or os.path.expanduser("~/.config")
    p = os.path.join(base, "hithink-finance", "credentials.env")
    if os.path.exists(p):
        for line in open(p, encoding="utf-8"):
            if line.startswith("HITHINK_FINANCE_API_KEY_DPAPI="):

• Confidence: 97% confidence
• Finding: This finding points to the same behavior: automatic access to a local .env-style credential store for HITHINK credentials. Even without exfiltration in this file, unauthorized secret discovery increases the attack surface and violates least-privilege expectations for a data-fetching skill that claims free, no-registration operation by default.

Credential Access

High

• Category: Privilege Escalation

Content

if k:
        return k
    base = os.environ.get("APPDATA") or os.path.expanduser("~/.config")
    p = os.path.join(base, "hithink-finance", "credentials.env")
    if os.path.exists(p):
        for line in open(p, encoding="utf-8"):
            if line.startswith("HITHINK_FINANCE_API_KEY_DPAPI="):

• Confidence: 97% confidence
• Finding: This finding points to the same behavior: automatic access to a local .env-style credential store for HITHINK credentials. Even without exfiltration in this file, unauthorized secret discovery increases the attack surface and violates least-privilege expectations for a data-fetching skill that claims free, no-registration operation by default.

Credential Access

High

• Category: Privilege Escalation

Content

def cred_path():
    base = os.environ.get("APPDATA") or os.path.expanduser("~/.config")
    return os.path.join(base, "hithink-finance", "credentials.env")


def _dpapi_protect(data):

• Confidence: 89% confidence
• Finding: Using a credentials.env file for API-key persistence creates a recognizable target for secret discovery by other local software, support tooling, or accidental inclusion in backups and sync processes. In this skill context, credential storage is more dangerous because the manifest emphasizes no-registration/free use, so users may be less prepared for secret-handling behavior.

Credential Access

High

• Category: Privilege Escalation

Content

def cred_path():
    base = os.environ.get("APPDATA") or os.path.expanduser("~/.config")
    return os.path.join(base, "hithink-finance", "credentials.env")


def _dpapi_protect(data):

• Confidence: 89% confidence
• Finding: Using a credentials.env file for API-key persistence creates a recognizable target for secret discovery by other local software, support tooling, or accidental inclusion in backups and sync processes. In this skill context, credential storage is more dangerous because the manifest emphasizes no-registration/free use, so users may be less prepared for secret-handling behavior.

Static analysis

No suspicious patterns detected.