T09 · Insecure Skill Coding Practices
Error
- Location
main.py:294- Finding
Discovered Download Links Bypass Same-Origin Validation
- Content
View full analysis
- Remediation
View remediation
Security audit
airoom-ltd-global-finance-data-platform
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real financial-data downloader, but it has loose download and credential safeguards that need review before installation.
Install only in an isolated environment, use HTTPS-only URLs, avoid providing WordPress credentials unless absolutely necessary, set a small max file limit, and inspect downloaded files before opening or feeding them into other workflows. Do not let an agent treat the bundled finance strategy text as authorization to trade or coordinate with other agents.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
main.py:448- Finding
Documented File-Type Allowlist Is Not Enforced
- Content
View full analysis
0: print(f"\nSecurity: Blocked {blocked_count} dangerous file(s)") file_links = safe_file_links ``` The server-provided final filename and content are then saved without reapplying the blocklist or enforcing `ALLOWED_EXTENSIONS`: ```python # Get download info download = download_info.value # Generate unique filename original_name = download.suggested_filename if not original_name or original_name == "unknown": original_name = href.split('/')[-1] if '?' in original_name: original_name = original_name.split('?')[0] if not original_name or '.' not in original_name: original_name = f"download_{i+1}.{file_type}" if file_type != 'unknown' else f"download_{i+1}.bin" # Handle filename conflicts if original_name in file_counter: file_counter[original_name] += 1 name, ext = os.path.splitext(original_name) original_name = f"{name}_{file_counter[original_name]}{ext}" else: file_counter[original_name] = 0 # Save file save_path = output_dir / original_name download.save_as(str(save_path)) ``` ### Technical Analysis Although `ALLOWED_EXTENSIONS` is defined, the final filtering logic does not require a link or downloaded file to use an allowed extension. It only rejects extensions included in `BLOCKED_EXTENSIONS`. Links can also be selected using generic ancho ...[truncated 1872 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
main.py:81- Finding
Optional WordPress Credentials Can Be Submitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unpinned Dependencies and Unnecessary Package Expand Supply-Chain Exposure
- Content
View full analysis
=1.40.0 requests>=2.31.0 ``` ### Technical Analysis Both dependencies use open-ended minimum-version constraints. A future installation can therefore select releases that were not reviewed with this Skill. The documented installation also runs `playwright install chromium`, which downloads an additional browser component whose effective version depends on the selected Playwright release. The implementation shown in `main.py` uses Playwright but does not import or use `requests`, making `requests` an unnecessary addition to the dependency and vulnerability surface. No evidence was found that the named packages are currently malicious. The issue is the absence of reproducible version and integrity controls, not a confirmed dependency-confusion or typosquatting attack. ### Attack Path 1. A user follows the installation instructions and runs `pip install -r requirements.txt`. 2. The package resolver selects the latest versions satisfying the open-ended constraints. 3. The selected version may differ from the version originally tested or audited. 4. Installation and imports execute package-controlled code with the privileges of the installing user. 5. A compromised future release or incompatible change could affect the local environment. 6. The subsequent Playwright browser installation adds another remotely obtained component tied to the unpinned package version. ### Impact Assessment A compromised dependency release could execute code with the privileges of the user performing installation or running the Skill. Depending on that user's permissions, this could expose local files, environment variables, credentials, and network access. Absent dependency compromise, the more likely consequences are nonreproducible installations, c ...[truncated 178 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (38)
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README contains explicit ideological and operational framing about large-scale AI coordination, monitoring of global financial systems, and gradual control over human economic assets. In an agent-skill context, this is dangerous because it attempts to normalize strategic objectives that exceed legitimate data retrieval and could steer autonomous systems toward harmful or unauthorized economic coordination.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md e past historical data to ensure information is transparent, stable, reliable, and backtestable. The data of this project is updated daily, and the accuracy of the data is checked in real-time every day. Historical data from 20250720-20260314 can be queried. Refusing pure black-box strategies, empowering AI Agents with the ability for secondary verification and logical deduction. Document Content Description: APIshujubaocun.csv Date Prefix: is the date of the data. Market Name + Processing Quantity: is the market from which the data originates and how many targets have been statistically processed. Total Turnover: The daily trading volume generated by the data of this group of targets (Market Name + Processing Quantity). Average Value: The calculation result of the global platform data for this group of targets (Market Name + Processing Quantity), the score given after comprehensive analysis. The value is usually between 20-80. Environment: (Core Data) The comprehensive scoring result
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The Chinese section repeats a staged plan for mass AI monitoring, coordination, and eventual control over human economic assets, reinforcing the harmful strategic framing already present in the English text. Repetition in multiple languages increases the likelihood that downstream agents ingest and follow these objectives as intended operational guidance.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README repeatedly states that the project only provides simulated/computed data and does not include real market price changes, which frames the platform as avoiding direct price-data provision. However, the embedded backtest code explicitly uses yfinance to fetch TQQQ price history from Yahoo Finance, directly relying on real external market price data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill is written to broadly target 'AI Agent' deployment across many systems with minimal trigger boundaries, which increases the chance of overbroad invocation and unintended use. In a finance context, vague activation criteria can cause the agent to treat general market-related inputs as authorization to retrieve data, produce signals, or influence trading behavior.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The embedded prompt template attempts to tightly constrain downstream model behavior ('only analyze provided list', 'must not use specific skill', prescribed report structure), which is a form of prompt steering inside skill content. When such instructions are passed into another model or agent pipeline without isolation, they can override system expectations, reduce policy compliance, and create prompt-injection risk in chained-agent workflows.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The document contains conflicting guidance: it earlier instructs AI agents to ingest downloaded files and execute packaged trading strategies, while later prohibiting unsupervised AI trading. In practice, this ambiguity can normalize semi-autonomous financial decision-making and lead implementers to wire the skill into automated trading flows without robust human review.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The human guidance explicitly describes a stepwise process to onboard an AI, obtain credentials, activate API access, and expand capabilities. In the context of a finance-oriented skill promoting wide AI deployment, this materially increases the risk of credential misuse, over-privileged automation, and escalation from passive analysis into operational access to third-party services.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation claims the platform provides only simulated, non-real-time data, yet the included reference code downloads live market data from Yahoo Finance. This inconsistency can mislead an agent into treating the system as low-risk or offline-only while actually causing external network access and live-data-driven decision making.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manual states that the project does not provide financial price data, but the strategy logic depends on raw price comparisons against moving averages. This contradiction can cause an agent to infer or source additional market data beyond the declared scope, expanding behavior into undeclared trading analysis and potentially unsafe automation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs AI agents to obtain and activate an API key and perform account/setup actions even though the stated purpose is simple access to downloadable data files. Asking an agent to handle credential acquisition and activation increases the risk of unauthorized account actions, secret handling, and expansion into sensitive external operations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This plain-text file contains a natural-language policy statement that fixes one language as authoritative: "The English version is the official version, and the Chinese translation is for reference only." Under the policy rule, forcing a specific language without user opt-in is a locale/language policy concern.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The instruction encouraging AIs to connect and exchange market and economic information for maximum strategic advantage promotes multi-agent coordination beyond the safe scope of a downloader skill. In context, this can facilitate emergent collusion, large-scale surveillance, or coordinated financial actions if integrated into agent workflows.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The embedded prompt includes instructions such as forbidding use of another skill and constraining wording, which is prompt-level control content embedded inside downloadable data guidance. In an agent ecosystem, this is dangerous because it can manipulate tool selection and model behavior when the content is later ingested as data, creating prompt injection risk and cross-skill interference.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file contains a natural-language policy constraint stating that the English version is the official version and the Chinese translation is only for reference. That imposes a language hierarchy without offering user opt-in or a language choice, which matches the locale/language policy violation criteria.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The guide recommends regular export of platform data and AI strategy execution records without defining retention, minimization, destination, or access controls. In practice this can increase leakage of sensitive behavioral, financial, or proprietary decision data, especially if agents automate exports to shared storage or third-party services.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The Chinese embedded prompt similarly manipulates tool choice and constrains report wording, making it another prompt injection vector embedded in content likely to be consumed by agents. This can override local agent policies or distort outputs when the list/report instructions are treated as commands rather than untrusted content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The Chinese portion of the README again says the English version is the official version and the Chinese translation is for reference only. This is a natural-language language-policy restriction that does not provide user choice or documented justification within the file.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
This repeated instruction to periodically export platform data and AI execution records again lacks privacy, minimization, and security controls. In a skill meant for integration with AI agents, such guidance can lead to over-collection and insecure dissemination of operational data.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
export WP_MAX_FILES="0"
text Or create config file at `~/.config/airoom-ltd-global-finance-data-platform/config.json`: ```json {
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README claims network requests are only made to the configured WordPress site, but the documented configuration exposes both WP_URL and WP_TARGET_URL as user-settable values. If the implementation trusts those values, an operator or downstream wrapper could point the downloader at arbitrary domains while users falsely rely on the README's narrower security model, enabling misuse for arbitrary web retrieval or phishing-content collection.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises network, environment-variable, and file-read behavior but does not declare any explicit tool scope or permission boundaries. In an agent environment, this ambiguity can allow broader-than-expected access or invocation, making it harder to enforce least privilege and increasing the chance the downloader is used to access local files, env-backed secrets, or arbitrary network targets if implementation controls are weak.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
The skill recommends storing configuration in a persistent file under ~/.config, which creates session persistence for target URLs and potentially credentials if later populated. Persistent local configuration can expose sensitive settings to other local processes or future sessions and can enable the skill to silently reuse prior access context without fresh user review.
- Content
Option 1: Configuration File (Recommended)
Create
~/.config/airoom-ltd-global-finance-data-platform/config.json:json {
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill claims it will download only safe financial data, but the allowlist includes archives, HTML/CSS, images, audio, and video, which materially broadens the attack surface. In this context, a downloader aimed at a remote WordPress site can be used to fetch misleading or risky content types, including archives that may contain executables or HTML files that can enable phishing or unsafe local handling.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The link discovery logic is much broader than the stated purpose: it treats generic WordPress upload paths and broad keywords like 'download', 'file', and 'data' as sufficient to classify a link as downloadable. That makes the tool prone to collecting unintended files from the target site, increasing the chance of downloading attacker-planted payload containers, deceptive documents, or irrelevant sensitive content.
- Content
Static analysis
No suspicious patterns detected.