UK Stock Market London Stock Exchange

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:21 AM UTC
• Version: 1.0.0

Overview

The skill appears to do what it says, but its install and example commands create avoidable credential and supply-chain risk.

Install only if you trust the OneKey Gateway and the @aiagenta2z npm package publisher. Prefer a pinned, local install over the global npm command, avoid npx auto-resolution, remove curl -v before using a real key, and rotate the key if it was ever captured in logs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8
• Finding: Unpinned Third-Party npm Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md:8-12` and `SKILL.md:52-58` **Vulnerability Type**: Unpinned third-party dependency and implicit package execution **Risk Level**: Medium ### Vulnerable Code ```yaml dependencies: npm: - "@aiagenta2z/onekey-gateway" installation: npm: npm -g install @aiagenta2z/onekey-gateway ``` ```shell ## install onekey agent gateway npm install @aiagenta2z/onekey-gateway ## CLI to Call API and Symbol List npx onekey agent aiagenta2z/financeagent get_uk_stock_market_lse '{"symbol_list": ["SHEL", "ULVR"]}' ``` ### Technical Analysis The npm dependency is specified without an exact version or integrity constraint. Consequently, installation resolves whatever package release the registry currently associates with the package name rather than a release reviewed during the skill audit. The documented `npx` invocation can also execute package-provided code. Depending on the local npm and `npx` environment, a missing executable may trigger package resolution or installation. npm packages can execute code through lifecycle scripts and their command-line entry points. The global installation recommendation further increases exposure by making the package available beyond an isolated project environment. This is a supply-chain weakness rather than evidence that the named package is currently malicious. Exploitation would require compromise or malicious publication of the package or one of its transitive dependencies. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, registry resolution path, or a transitive dependency. 2. The attacker publishes a malicious release under the package name or causes an unsafe dependency version to be resolved. 3. A user or Agent follows the skill instructions and runs the unpinned `npm install`, global installation, or `npx` command. 4. npm retrieves the attacker-controlled release. 5. Malicious lifecycle or runtime code executes with the p ...[truncated 651 chars]
• Remediation: ## Remediation Suggestions 1. Pin the dependency to a reviewed exact version rather than using an unconstrained package name. 2. Maintain a lockfile containing registry-resolved integrity hashes and install with `npm ci`. 3. Verify the package publisher, repository, release provenance, and transitive dependency tree. 4. Avoid global installation; use a project-local, isolated dependency environment. 5. Avoid `npx` behavior that can implicitly download packages. Invoke an already installed, version-pinned local binary instead. 6. Disable unnecessary lifecycle scripts during installation where compatible with the package, for example by using `--ignore-scripts`. 7. Run the package under a least-privileged account or sandbox with restricted filesystem, environment-variable, and network access. 8. Document the expected package version and trusted registry explicitly so dependency changes receive a new security review.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:65
• Finding: API Key Disclosure Through Verbose curl Output## Vulnerability Details **File Location**: `SKILL.md:63-75` **Vulnerability Type**: Sensitive authentication header exposed through verbose diagnostic logging **Risk Level**: Medium ### Vulnerable Code ```shell export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -v -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{ "unique_id": "aiagenta2z/financeagent", "api_id": "get_uk_stock_market_lse", "data": { "symbol_list": ["SHEL", "ULVR"] } }' ``` ### Technical Analysis The command enables curl's verbose mode with `-v` while placing the OneKey credential in the `X-OneKey` request header. Verbose curl output writes diagnostic information, including outgoing request headers, to standard error. Shell expansion replaces `$DEEPNLP_ONEKEY_ROUTER_ACCESS` with the actual credential before the request is sent. As a result, the authentication header and key may be captured by terminal recording, CI/CD logs, Agent execution transcripts, debugging output, support bundles, or redirected standard error. TLS protects the credential in transit but does not prevent this local logging disclosure. ### Attack Path 1. A user stores a valid API key in `DEEPNLP_ONEKEY_ROUTER_ACCESS`. 2. The user or an automated Agent executes the documented curl command. 3. The shell expands the environment variable into the `X-OneKey` header. 4. The `-v` option causes curl to emit the outgoing authentication header to standard error. 5. A terminal recorder, CI system, log collector, transcript mechanism, or redirected output retains the diagnostic text. 6. An attacker or unauthorized user with access to those records extracts the API key. 7. The exposed key is reused to make requests through the OneKey Gateway until it expires or is revoked. ### Impact Assessment An attacker who obtains the key may impersonate its owner to the OneKey Gateway and exercise the APIs and quot ...[truncated 511 chars]
• Remediation: ## Remediation Suggestions 1. Remove `-v` from the standard usage example. 2. If diagnostics are necessary, use a sanitized tracing mechanism that redacts `X-OneKey` and other authentication headers before output is stored. 3. Configure CI systems and Agent runtimes to mask the credential value in standard output, standard error, and execution transcripts. 4. Prevent secret-bearing debug logs from being retained or included in support bundles. 5. Use a dedicated secret manager or protected runtime injection rather than manually exposing credentials in persistent shell configuration. 6. Issue narrowly scoped, short-lived credentials where the gateway supports them. 7. Rotate the API key immediately if verbose output containing a real value has already been retained or shared. 8. Add documentation warning users never to publish request traces or verbose output containing authentication headers.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

External Transmission

Medium

• Category: Data Exfiltration

Content

```shell
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key

curl -v -X POST "https://agent.deepnlp.org/agent_router" \
  -H "Content-Type: application/json" \
  -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \
  -d '{

• Confidence: 92% confidence
• Finding: The skill instructs users to send requests and an API credential (`X-OneKey`) to an external service at `agent.deepnlp.org`, which is an external transmission of secrets and user-requested data. In context, this is the intended function of the integration, so it is not overtly malicious, but it still creates a real confidentiality and trust-boundary risk because the skill depends on a remote third-party gateway handling credentials and query data.

Static analysis

No suspicious patterns detected.