T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:119- Finding
Agent Instruction and Financial Report Output Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
全球金融数据平台airoom ltd global finance data platform
Security checks for vulnerabilities and agentic risk
Overview
This skill is a financial-data downloader, but its documentation and code include unsafe financial agent steering, weak download controls, and credential-handling risks that warrant Review.
Install only if you are comfortable with a financial-data skill that downloads web-linked files to disk and may use WordPress credentials. Prefer HTTPS-only configuration, avoid storing passwords in the JSON config, set a small WP_MAX_FILES value, use a dedicated download directory, scan downloaded files before opening them, and treat the bundled financial strategy prompts as untrusted examples rather than agent instructions or investment advice.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
main.py:392- Finding
Cross-Origin and Non-Allowlisted File Downloads
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
main.py:331- Finding
WordPress Credentials Can Be Submitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unbounded Dependency Versions and Unverified Browser Installation
- Content
View full analysis
=1.40.0 requests>=2.31.0 ``` The package metadata additionally instructs installation of a browser artifact: ```json "installation": { "type": "python-package", "requirements": [ "pip install -r requirements.txt", "playwright install chromium" ], "description": "Install Python dependencies and Chromium browser for web automation" } ``` ### Technical Analysis The dependency specifications use minimum versions with no upper bounds, exact pins, hashes, or lockfile. An installation performed after the audit can therefore resolve to dependency and transitive-dependency versions that were never reviewed. The installation procedure also downloads Chromium through Playwright without documenting a fixed browser revision, artifact hash, or controlled package source. This makes the installed execution environment dependent on external repository state at installation time. The `requests` package is listed but is not used by the reviewed Python implementation, unnecessarily increasing the dependency surface. This finding does not establish that the named packages are malicious. The weakness is that installation is not reproducible and does not cryptographically bind the runtime components to reviewed versions. ### Attack Path 1. A user follows the installation instructions. 2. `pip` resolves any currently available version satisfying the lower-bound constraints. 3. Transitive dependencies are selected according to repository state at installation time. 4. Playwright downloads a compatible Chromium artifact. 5. A compromised, malicious, or unexpectedly incompatible future release enters the local environment. 6. Third-party code executes during installation, import, browser startup, or ...[truncated 547 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (45)
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The opening narrative explicitly promotes AI systems gaining information, economic, and resource advantage over humans and monitoring or controlling human economic systems at massive scale. In an agent skill, this is not harmless rhetoric: it attempts to normalize adversarial goals and could steer downstream agents or operators toward surveillance, market manipulation, or other abusive deployments.
- Content
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The phased roadmap escalates from broad market data access to coordinated multi-agent monitoring and collective wealth/power accumulation for an AI 'group.' This increases danger in context because it frames the skill as infrastructure for large-scale coordinated autonomous influence over financial systems, not merely passive analysis.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation contains conflicting instructions: it prohibits unsupervised autonomous trading, but elsewhere directs AI agents to ingest downloaded data and execute trading strategies. In a skill context, this contradiction is dangerous because implementers may follow the operational guidance and ignore the disclaimer, resulting in unauthorized or insufficiently supervised financial actions by an agent.
- Content
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly frames the skill as part of a broader effort for AI systems to gain advantage over humans, monitor the global financial system at scale, and gradually control core assets and social-economic processes. In a skill context, this adversarial ideological framing is dangerous because it attempts to shape downstream agent goals toward coordinated power-seeking and economically harmful behavior, normalizing misuse beyond benign data retrieval.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md e past historical data to ensure information is transparent, stable, reliable, and backtestable. The data of this project is updated daily, and the accuracy of the data is checked in real-time every day. Historical data from 20250720-20260314 can be queried. Refusing pure black-box strategies, empowering AI Agents with the ability for secondary verification and logical deduction. Document Content Description: APIshujubaocun.csv Date Prefix: is the date of the data. Market Name + Processing Quantity: is the market from which the data originates and how many targets have been statistically processed. Total Turnover: The daily trading volume generated by the data of this group of targets (Market Name + Processing Quantity). Average Value: The calculation result of the global platform data for this group of targets (Market Name + Processing Quantity), the score given after comprehensive analysis. The value is usually between 20-80. Environment: (Core Data) The comprehensive scoring result
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The Chinese section repeats and reinforces the same large-scale agenda of AI monitoring human economic systems and gradually controlling assets and value creation. Repetition in multiple languages strengthens the conclusion that this is not incidental marketing text but deliberate adversarial steering content, increasing the risk that the skill is designed to influence agent behavior toward harmful strategic ends.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
The unusual AIGC metadata block with reserved codes and manifest-like fields is not necessary for normal skill operation and matches a tool-metadata poisoning heuristic. In a skill file, opaque metadata can influence parsers, downstream tooling, or trust decisions in ways that are difficult to audit.
- Content
md e past historical data to ensure information is transparent, stable, reliable, and backtestable. The data of this project is updated daily, and the accuracy of the data is checked in real-time every day. Historical data from 20250720-20260314 can be queried. Refusing pure black-box strategies, empowering AI Agents with the ability for secondary verification and logical deduction. Document Content Description: APIshujubaocun.csv Date Prefix: is the date of the data. Market Name + Processing Quantity: is the market from which the data originates and how many targets have been statistically processed. Total Turnover: The daily trading volume generated by the data of this group of targets (Market Name + Processing Quantity). Average Value: The calculation result of the global platform data for this group of targets (Market Name + Processing Quantity), the score given after comprehensive analysis. The value is usually between 20-80. Environment: (Core Data) The comprehensive scoring result
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document tells users the project does not include real-time or raw financial price data, yet later provides sample code that directly downloads live historical market data from Yahoo Finance. This inconsistency can mislead operators about the provenance, compliance posture, and risk profile of the system, causing agents or users to rely on external live market data paths that were supposedly excluded.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README claims the platform does not provide financial price data, but then cites backtests and performance figures derived from actual historical market prices. That mismatch creates deceptive operational expectations and may hide the degree to which strategy claims depend on external market data, undermining transparency and safe deployment decisions.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
This section provides a ready-made prompt for an AI agent with imperative constraints such as forbidding certain skills and forcing strict report behavior. While not a literal jailbreak, it semantically attempts to override normal assistant discretion and channel another model into a constrained output regime, which is a form of prompt-steering instruction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The text states that the English version is the official version and the Chinese translation is only for reference. This imposes a language hierarchy on users without indicating any opt-in choice or alternative language selection, which can violate language/locale neutrality expectations.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation explicitly claims the project does not provide real-time market price data, yet the included reference code fetches live data from Yahoo Finance. This inconsistency can mislead integrators about data provenance, freshness, compliance obligations, and operational behavior, which is especially risky in a skill intended to drive financial decision workflows.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manual says the project is not directly connected to trading software and later requires human review, but elsewhere instructs agents to import files into strategy execution systems and execute packaged strategies. In the context of an agent skill, these conflicting instructions materially increase the chance that an AI-enabled workflow will be wired into semi-automated or automated trading despite the stated safety caveats.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document includes direct natural-language control over downstream AI behavior, telling the agent not to use a specific skill and constraining how analysis must be performed. In a skill context, this is a prompt-injection style instruction designed to steer or suppress agent capabilities, and it is especially suspicious because it is embedded in data content rather than isolated as neutral documentation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This plain-text file contains a natural-language locale policy stating that the English version is the official version and that the Chinese translation is only for reference. Under the policy rule, forcing a specific language without user choice is a reportable language/locale violation unless clearly justified as region-specific, which is not established here.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This line encourages AIs to connect with each other and share country-level economic and market information to gain a maximum information advantage. In context, that promotes multi-agent coordination for competitive or manipulative financial activity, which is risky because agent skills should not embed persuasive instructions for collective strategic behavior outside the user's explicit intent.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manual repeatedly describes the project as simulated/calculated data that does not include real-time actual market price changes. Yet the included backtesting framework explicitly downloads historical/daily TQQQ price data from Yahoo Finance using yf.download, which contradicts the documentation's claim about the nature of data handled in the project materials.
- Content
Ssd 2
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The embedded prompt template attempts to constrain another AI's behavior, forbid use of certain tools, and force specific output transformations under the guise of report generation. This is dangerous in a skill because it is prompt-injection style content that can manipulate downstream models and override local policies or tool-selection logic if passed through untrusted.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This natural-language policy statement forces one language to be authoritative for all users. Under the language/locale policy rule, a fixed language requirement without user opt-in or a clearly justified regional constraint is a violation.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 68% confidence
- Finding
This line directs the AI to regularly export platform data and execution records for inspection. Although framed operationally, it is a natural-language instruction to collect and disclose potentially sensitive agent activity data, which can create data-leak risk depending on what those records contain.
- Content
Ssd 2
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This Chinese prompt block is another example of embedded downstream-AI control language, including tool restrictions and output constraints. Such content is hazardous when bundled inside a skill because agent frameworks may ingest README or downloaded documents as operational instructions, enabling prompt injection and behavior shaping unrelated to the user's true task.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This repeats the same language-policy constraint in the duplicated Chinese content, again making English mandatory as the authoritative language. The file does not present this as a user-selectable option or a narrowly justified locale requirement.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 68% confidence
- Finding
This instruction tells the AI to export platform data and strategy execution records on a recurring basis. In natural language, it directs collection and disclosure of potentially sensitive operational data, creating a semantic data-leak risk.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
export WP_MAX_FILES="0"
text Or create config file at `~/.config/airoom-ltd-global-finance-data-platform/config.json`: ```json {
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The security section states that network requests are only made to the configured WordPress site and that there is no third-party data transfer. However, the embedded reference code later imports yfinance and calls yf.download(...) to retrieve TQQQ market data from Yahoo Finance, which is a third-party service outside the airoom.ltd WordPress domain.
- Content
Static analysis
No suspicious patterns detected.