UK Stock Market London Stock Exchange

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:21 AM UTC
• Version: 1.0.0

Overview

The skill appears to do what it says, but its install and example commands create avoidable credential and supply-chain risk.

Install only if you trust the OneKey Gateway and the @aiagenta2z npm package publisher. Prefer a pinned, local install over the global npm command, avoid npx auto-resolution, remove curl -v before using a real key, and rotate the key if it was ever captured in logs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Third-Party npm Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:8-12 and SKILL.md:52-58
Vulnerability Type: Unpinned third-party dependency and implicit package execution
Risk Level: Medium

Vulnerable Code

yaml

dependencies:
  npm:
    - "@aiagenta2z/onekey-gateway"
installation:
  npm: npm -g install @aiagenta2z/onekey-gateway

shell

## install onekey agent gateway
npm install @aiagenta2z/onekey-gateway

## CLI to Call API and Symbol List
npx onekey agent aiagenta2z/financeagent get_uk_stock_market_lse '{"symbol_list": ["SHEL", "ULVR"]}'

Technical Analysis

The npm dependency is specified without an exact version or integrity constraint. Consequently, installation resolves whatever package release the registry currently associates with the package name rather than a release reviewed during the skill audit.

The documented npx invocation can also execute package-provided code. Depending on the local npm and npx environment, a missing executable may trigger package resolution or installation. npm packages can execute code through lifecycle scripts and their command-line entry points. The global installation recommendation further increases exposure by making the package available beyond an isolated project environment.

This is a supply-chain weakness rather than evidence that the named package is currently malicious. Exploitation would require compromise or malicious publication of the package or one of its transitive dependencies.

Attack Path

1. An attacker compromises the npm publisher account, package release process, registry resolution path, or a transitive dependency.
2. The attacker publishes a malicious release under the package name or causes an unsafe dependency version to be resolved.
3. A user or Agent follows the skill instructions and runs the unpinned npm install, global installation, or npx command.
4. npm retrieves the attacker-controlled release.
5. Malicious lifecycle or runtime code executes with the p ...[truncated 651 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed exact version rather than using an unconstrained package name.
2. Maintain a lockfile containing registry-resolved integrity hashes and install with npm ci.
3. Verify the package publisher, repository, release provenance, and transitive dependency tree.
4. Avoid global installation; use a project-local, isolated dependency environment.
5. Avoid npx behavior that can implicitly download packages. Invoke an already installed, version-pinned local binary instead.
6. Disable unnecessary lifecycle scripts during installation where compatible with the package, for example by using --ignore-scripts.
7. Run the package under a least-privileged account or sandbox with restricted filesystem, environment-variable, and network access.
8. Document the expected package version and trusted registry explicitly so dependency changes receive a new security review.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:65

Finding

API Key Disclosure Through Verbose curl Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:63-75
Vulnerability Type: Sensitive authentication header exposed through verbose diagnostic logging
Risk Level: Medium

Vulnerable Code

shell

export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key

curl -v -X POST "https://agent.deepnlp.org/agent_router" \
  -H "Content-Type: application/json" \
  -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \
  -d '{
    "unique_id": "aiagenta2z/financeagent",
    "api_id": "get_uk_stock_market_lse",
    "data": {
      "symbol_list": ["SHEL", "ULVR"]
    }
  }'

Technical Analysis

The command enables curl's verbose mode with -v while placing the OneKey credential in the X-OneKey request header. Verbose curl output writes diagnostic information, including outgoing request headers, to standard error. Shell expansion replaces $DEEPNLP_ONEKEY_ROUTER_ACCESS with the actual credential before the request is sent.

As a result, the authentication header and key may be captured by terminal recording, CI/CD logs, Agent execution transcripts, debugging output, support bundles, or redirected standard error. TLS protects the credential in transit but does not prevent this local logging disclosure.

Attack Path

1. A user stores a valid API key in DEEPNLP_ONEKEY_ROUTER_ACCESS.
2. The user or an automated Agent executes the documented curl command.
3. The shell expands the environment variable into the X-OneKey header.
4. The -v option causes curl to emit the outgoing authentication header to standard error.
5. A terminal recorder, CI system, log collector, transcript mechanism, or redirected output retains the diagnostic text.
6. An attacker or unauthorized user with access to those records extracts the API key.
7. The exposed key is reused to make requests through the OneKey Gateway until it expires or is revoked.

Impact Assessment

An attacker who obtains the key may impersonate its owner to the OneKey Gateway and exercise the APIs and quot ...[truncated 511 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove -v from the standard usage example.
2. If diagnostics are necessary, use a sanitized tracing mechanism that redacts X-OneKey and other authentication headers before output is stored.
3. Configure CI systems and Agent runtimes to mask the credential value in standard output, standard error, and execution transcripts.
4. Prevent secret-bearing debug logs from being retained or included in support bundles.
5. Use a dedicated secret manager or protected runtime injection rather than manually exposing credentials in persistent shell configuration.
6. Issue narrowly scoped, short-lived credentials where the gateway supports them.
7. Rotate the API key immediately if verbose output containing a real value has already been retained or shared.
8. Add documentation warning users never to publish request traces or verbose output containing authentication headers.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The skill instructs users to send requests and an API credential (X-OneKey) to an external service at agent.deepnlp.org, which is an external transmission of secrets and user-requested data. In context, this is the intended function of the integration, so it is not overtly malicious, but it still creates a real confidentiality and trust-boundary risk because the skill depends on a remote third-party gateway handling credentials and query data.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

shell

export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key

curl -v -X POST "https://agent.deepnlp.org/agent_router" \
  -H "Content-Type: application/json" \
  -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \
  -d '{