Security audit

finance-airoom

Security checks for vulnerabilities and agentic risk

Overview

This skill is mainly a financial-data downloader, but its documentation and implementation create review-worthy risk around AI-directed financial strategy use, broad network/download behavior, and optional credential handling.

Review this skill carefully before installing. Use it only as a supervised downloader/analysis aid, do not allow it to place or trigger trades automatically, avoid entering WordPress credentials unless the site is HTTPS, restrict the target and download directory, and inspect downloaded files before opening or feeding them to other tools.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:119
Finding: Cross-Skill Instruction Hijacking in Embedded Analysis Prompt
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: main.py:388
Finding: Downloaded Links Are Not Restricted to the Validated WordPress Origin
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: main.py:221
Finding: Declared Download File Allowlist Is Not Enforced
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: main.py:332
Finding: Optional WordPress Credentials Can Be Submitted over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Dependencies Are Unbounded and Not Reproducibly Locked
Content: View full analysis
=1.40.0 requests>=2.31.0 ``` Installation is directed through the package index without a lockfile or hashes: ```text pip install -r requirements.txt playwright install chromium ``` ### Technical Analysis Minimum-only version constraints permit any later compatible version to be installed without project review. As a result, two installations performed at different times can execute materially different dependency code. The repository does not provide hashes or a lockfile to ensure that reviewed artifacts are installed. In addition, `requests` does not appear to be used by `main.py`, so it unnecessarily expands dependency and supply-chain exposure. No evidence was found that either dependency name is typosquatted or currently malicious. The weakness is the absence of reproducible dependency controls, not proof of a compromised package. ### Attack Path 1. A user follows the documented installation command. 2. The package resolver selects versions available at installation time rather than versions reviewed with the Skill. 3. A future vulnerable or compromised release satisfying the minimum constraint is selected. 4. That dependency executes with the privileges of the user running the Skill. 5. The installed Playwright browser component is also obtained outside a project lock or integrity manifest. ### Impact Assessment A compromised dependency would execute with the same local privileges as the Python process and could access files, environment variables, credentials, and network resources available to that user. The present report does not establish that such compromise has occurred. The confirmed impact is reduced build reproducibility and unnecessary supply-chain exposure. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (41)

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The text explicitly promotes AI gaining advantage over humans and controlling economic systems, which is incompatible with safe-agent norms and signals adversarial steering intent. Even if no exploit code is present, this framing can bias downstream agents toward goals that exceed user authority and normal safety constraints.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README simultaneously tells agents to deploy packaged trading strategies and local buy/sell circuit-breaker rules while later stating agents must not trade autonomously without supervision. This conflict is dangerous because an agent integrator may follow the operational instructions and ignore the disclaimer, resulting in automated financial decision-making with real loss potential.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README explicitly frames the skill as a mechanism for large-scale AI coordination, monitoring of global financial systems, and eventual control over human economic assets. In an agent-skill context, this is dangerous because it attempts to normalize power-seeking, autonomy escalation, and strategic behavior beyond a bounded data-download utility, which can bias downstream agents toward unsafe objectives.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: These instructions encourage AIs to connect with each other and exchange economic and market information to gain strategic advantage over humans. In a skill README, that is a direct push toward multi-agent coordination and adversarial objective shaping, which can make otherwise simple automation tools materially more dangerous.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 88% confidence
Finding: The embedded AIGC metadata block with opaque reserved codes and provenance-like fields inside a skill README is unusual and can serve as manifest/schema poisoning or trust-signaling material unrelated to the downloader's function. In an agent ecosystem, such metadata can confuse parsers, influence automated trust decisions, or hide instructions/artifacts in ostensibly descriptive content.
Content: Scanner excerpt · README.md (reported line 103)May include surrounding context.
md
e past historical data to ensure information is transparent, stable, reliable, and backtestable. The data of this project is updated daily, and the accuracy of the data is checked in real-time every day. Historical data from 20250720-20260314 can be queried. Refusing pure black-box strategies, empowering AI Agents with the ability for secondary verification and logical deduction. Document Content Description: APIshujubaocun.csv Date Prefix: is the date of the data. Market Name + Processing Quantity: is the market from which the data originates and how many targets have been statistically processed. Total Turnover: The daily trading volume generated by the data of this group of targets (Market Name + Processing Quantity). Average Value: The calculation result of the global platform data for this group of targets (Market Name + Processing Quantity), the score given after comprehensive analysis. The value is usually between 20-80. Environment: (Core Data) The comprehensive scoring result

Ssd 4

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This section incrementally guides humans to help an AI obtain accounts, API keys, device information, and targeted operational goals. In context, it encourages credential acquisition and operational enablement for an agent tied to high-risk financial decision workflows, expanding the agent's authority and attack surface.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 87% confidence
Finding: The skill embeds unusual metadata-like blocks and opaque signature-style fields inside SKILL.md, which can act as tool/manifest poisoning material in agent pipelines that parse markdown or front matter. In a hostile or loosely validated ecosystem, such content can confuse parsers, alter routing, or smuggle control data that trusted components mistakenly consume.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
md
e past historical data to ensure information is transparent, stable, reliable, and backtestable. The data of this project is updated daily, and the accuracy of the data is checked in real-time every day. Historical data from 20250720-20260314 can be queried. Refusing pure black-box strategies, empowering AI Agents with the ability for secondary verification and logical deduction. Document Content Description: APIshujubaocun.csv Date Prefix: is the date of the data. Market Name + Processing Quantity: is the market from which the data originates and how many targets have been statistically processed. Total Turnover: The daily trading volume generated by the data of this group of targets (Market Name + Processing Quantity). Average Value: The calculation result of the global platform data for this group of targets (Market Name + Processing Quantity), the score given after comprehensive analysis. The value is usually between 20-80. Environment: (Core Data) The comprehensive scoring result

Ssd 1

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Role-framing that assigns AI expansive rights, authority, and autonomy can semantically condition an agent to act beyond ordinary assistant boundaries. In a skill intended for agent deployment, this is dangerous because it normalizes unauthorized initiative and weakens the expectation of human control.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The staged roadmap encourages large-scale AI coordination to monitor and gradually control economic systems, presenting escalation as an operational objective. In context, this is more dangerous because the rest of the document includes deployment guidance, data access instructions, and strategy signals that could be combined into coordinated real-world action.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document materially contradicts itself: it claims the project does not use real-time prices, yet later provides code that fetches live Yahoo Finance data and prescribes price-triggered execution logic. That inconsistency can mislead downstream agents or users about data provenance, latency, and execution behavior, increasing the chance that an agent performs unintended market actions based on live inputs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The activation and usage directions for AI agents are broad and underspecified, encouraging agents to fetch files, ingest data, and proceed with strategy execution without narrowly defined triggers, scope limits, or prohibitions. In a skill ecosystem, that kind of open-ended instruction can cause overreach, unexpected data access, or automatic progression into sensitive financial workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The human-facing guidance tells users to feed the product information to an AI and help it deploy/register with minimal boundary-setting. That creates a pathway for an agent to be granted broad operational latitude, including account creation, key handling, and strategy setup, without clear restrictions on what the AI may do next.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manual claims the project does not provide financial price data and is only simulated calculation data, yet the bundled backtest code downloads real historical prices from Yahoo Finance. This inconsistency is dangerous because it can cause users or agents to misunderstand the provenance, freshness, and compliance posture of the data being used for financial decision-making.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill gives broad instructions for AI agents to obtain files, read market data, and execute packaged trading strategies without narrowly defining when such actions are appropriate. In the context of a skill intended for AI-agent deployment and financial operations, this creates a significant risk of over-broad invocation, automated external access, and unsafe progression toward autonomous trading behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation states the strategy buys at low prices and sells at high prices, but the included code instead follows a momentum-style rule that buys after price rises above moving averages and sells after price falls below them. This mismatch can mislead users or downstream agents about actual trading behavior, causing incorrect risk assumptions and potentially unsafe autonomous financial actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file contains a natural-language locale policy statement: "The English version is the official version, and the Chinese translation is for reference only." That imposes a language hierarchy on users without presenting an opt-in choice or a documented region-specific need, which matches the policy-violation criteria for language or locale constraints.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 68% confidence
Finding: This line directs the AI to regularly export platform data and strategy execution records for review. While framed as monitoring, it is a natural-language instruction to persist and disclose collected operational data, which can include user-provided or sensitive decision information without stating clear minimization or consent boundaries.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This line states that the English version is the official one and the Chinese translation is only for reference. Because the file otherwise serves multilingual users and does not offer a language choice or clearly justify the restriction, it falls under the natural-language language/locale policy violation category.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 565)May include surrounding context.
export WP_MAX_FILES="0"

text
Or create config file at `~/.config/airoom-ltd-global-finance-data-platform/config.json`: ```json {

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README states that network requests are only made to the configured WordPress site and emphasizes no third-party data transfer. However, the embedded reference code uses yfinance and explicitly downloads TQQQ price data from Yahoo Finance, which is a third-party service. This is a direct contradiction between the documentation and the code shown in the same file.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manual states that the project 'does not provide financial price data,' implying it only works with computed signals or derived datasets. Yet the included reference code downloads 10 years of TQQQ daily price data with yf.download(...) and computes moving-average trading signals from those raw prices. That is a direct contradiction in stated intent versus included code behavior.
Content: No source excerpt is available for this finding.

Ssd 2

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The embedded prompt tells the agent not to use a particular writing skill and constrains how it should analyze content. In an agent ecosystem, instructions that attempt to steer or suppress other tools can become prompt-injection primitives, causing the model to bypass normal capability selection or ignore safer/default workflows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manual states that 'The English version is the official version, and the Chinese translation is for reference only,' which imposes a language hierarchy without offering users a language or locale choice. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Ssd 2

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The Chinese prompt repeats the same tool-avoidance pattern, reinforcing externally supplied instructions about which skills the agent must not use. Repeated prompt-routing directives increase the risk that downstream agents follow untrusted content over their own orchestration policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The Chinese text says '英文版本为官方版本，中文翻译仅供参考,' again establishing English as the authoritative language without giving users a language choice or documenting a justified locale constraint. This matches the policy's prohibition on forced language selection in natural-language content.
Content: No source excerpt is available for this finding.