T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyser.py:123- Finding
Unauthenticated HTTP Transport Allows Market-Data Response Manipulation
- Content
View full analysis
- Remediation
View remediation
Security audit
Stock Monitor Skill 0.1.0
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed stock-monitoring skill that runs a user-started background watcher and contacts market-data providers, with some quality and hardening issues but no hidden or destructive behavior found.
Before installing, be aware that this skill is aimed at Chinese-speaking China-market workflows, runs as a local background process when started, logs under ~/.stock_monitor, and sends your configured watchlist symbols to external market-data/news services. Treat its alerts and advice as informational, and prefer hardening the HTTP endpoint and PID validation before relying on it heavily.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/control.sh:24- Finding
Stale or Manipulated PID File Can Terminate an Unrelated User Process
- Content
View full analysis
/dev/null; then echo "🛑 停止监控进程 (PID: $PID)..." kill "$PID" rm "$PID_FILE" echo "✅ 已停止" ``` ### Technical Analysis The stop operation trusts the numeric value stored in `~/.stock_monitor/monitor.pid`. The `kill -0` check only establishes that a process with that PID exists and is signalable by the current user. It does not establish that the process is the stock monitor daemon. If the daemon terminates unexpectedly, the PID file is not guaranteed to be removed. The operating system may later assign the same PID to another process. Running `control.sh stop` would then send `SIGTERM` to that unrelated process. A same-user actor able to modify the PID file can also replace its contents with the PID of another process owned by that user. Input is not validated as a strictly positive numeric PID, and the process executable or command line is not checked before signaling it. ### Attack Path #### Stale PID exploitation 1. The monitor starts and writes its PID to `~/.stock_monitor/monitor.pid`. 2. The daemon exits unexpectedly without deleting the PID file. 3. The operating system reuses the recorded PID for an unrelated process. 4. The user later runs `./control.sh stop`. 5. `kill -0` succeeds because the unrelated process exists. 6. The script sends `SIGTERM` to the unrelated process. #### PID-file manipulation 1. A same-user process or actor with write access to the PID file replaces its contents with another same-user process ID. 2. The user invokes the stop command. 3. The script accepts the substituted PID without checking process identity. 4. The selected process receives `SIGTERM`. ### Impact Assessment The issue can te ...[truncated 409 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the shipped code is primarily developer QA or validation infrastructure while the skill is presented as end-user monitoring functionality, reviewers and users may misunderstand what actually runs. This is dangerous because test harnesses often have broader access, weaker hardening, or behavior inconsistent with production claims, which can expand attack surface and reduce transparency.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the shipped code is primarily developer QA or validation infrastructure while the skill is presented as end-user monitoring functionality, reviewers and users may misunderstand what actually runs. This is dangerous because test harnesses often have broader access, weaker hardening, or behavior inconsistent with production claims, which can expand attack surface and reduce transparency.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the shipped code is primarily developer QA or validation infrastructure while the skill is presented as end-user monitoring functionality, reviewers and users may misunderstand what actually runs. This is dangerous because test harnesses often have broader access, weaker hardening, or behavior inconsistent with production claims, which can expand attack surface and reduce transparency.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README presents the skill name's description, feature list, and setup note entirely in Chinese, which effectively forces a specific language for users. The policy allows locale constraints only when they are optional or clearly documented and justified, which is not present here.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 82% confidence
- Finding
The skill documentation declares no explicit tool scope or permissions, while the accompanying analysis indicates network-capable behavior exists elsewhere in the skill. Missing scope declarations are dangerous because they hide the true execution and data-access surface from reviewers and users, making unexpected external requests harder to audit and constrain.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a stock monitoring and alerting system centered on seven specific warning rules such as cost percentage, moving-average crosses, RSI, volume anomalies, gaps, and trailing take-profit. This file's module description and implemented methods instead expand into broader market-intelligence functions including news scraping, sentiment analysis, capital-flow retrieval,龙虎榜 data, and gold-price correlation analysis, which are materially beyond the described alert-rule scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file-level description and class docstring are entirely in Chinese and present the skill as a general-purpose stock analysis engine, with no indication that language is configurable or limited to a China-specific deployment context. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh echo "🚀 启动 Stock Monitor 后台进程..." mkdir -p "$LOG_DIR" nohup python3 "$SCRIPT_DIR/monitor_daemon.py" > "$LOG_DIR/monitor.log" 2>&1 & echo $! > "$PID_FILE" echo "✅ 已启动 (PID: $!)" echo "📋 日志: $LOG_DIR/monitor.log"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file's natural-language description and user-facing alert messages are entirely in Chinese, and locale-specific conventions are embedded in comments and output formatting. There is no indication that the language is configurable or that the skill is intentionally restricted to a Chinese-speaking or China-specific context with explicit user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring uses Chinese for core operational descriptions, and the file continues to use Chinese user-facing strings in logs. Under the policy rule, forcing a specific language without opt-in or justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring is entirely in Chinese and presents the test suite description in a single fixed language. This is a natural-language locale policy concern because the file does not offer an opt-in language choice or explain why Chinese is required for a region-specific audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description states the skill '符合中国投资者习惯（红涨绿跌）', which bakes in a China-specific market display convention by default. The file does not indicate that users can choose their preferred color/locale convention or that this behavior is limited to a region-specific deployment.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
These lines explicitly define '红色 = 上涨 / 盈利' and '绿色 = 下跌 / 亏损' as the skill's convention. Because color semantics vary by market and locale, hardcoding this behavior without opt-in or a documented locale scope creates a language/locale policy issue.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The function is documented as analyzing the relationship between gold price and portfolio stocks, implying the input gold_price affects the analysis. In reality, the code never uses gold_price and simply looks up stock codes in a fixed correlation_map, so the documented intent contradicts the actual behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script's comments, status messages, and usage output are presented entirely in Chinese, including operational prompts shown during start, stop, status, and help flows. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill sends the user-configured watchlist symbols and market interests to third-party data providers without any user-facing notice or consent flow. While the transmitted data is not highly sensitive by itself, investment interests can still reveal private financial preferences and behavior patterns, especially if correlated over time by external services.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a stock monitoring and alerting system centered on seven warning-rule types. This function adds a separate news retrieval capability, which is not referenced in the manifest description and is not necessary to implement the stated alert rules.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill's stated purpose is monitoring stocks and generating technical/price-based alerts. Accessing a company survey/news endpoint is a separate informational capability and is not obviously required for the declared alerting behavior, especially since the returned value is only a placeholder string.
- Content