stock-hot-zh-aisa

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:49 AM UTC
• Version: 1.0.0

Overview

This stock and crypto scanner is mostly coherent, but it can send its AISA API key to an arbitrary configured endpoint, so it should be reviewed before use.

Install only if you trust the publisher and the environment where it will run. Keep AISA_BASE_URL unset unless you intentionally use a trusted endpoint, avoid placing sensitive personal information in prompts that trigger the scanner, and prefer a pinned reviewed dependency version for operational use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/hot_scanner.py:99

Finding

API Credential Can Be Redirected to an Arbitrary Server

Content

View full analysis

Vulnerability Details

File Location: scripts/hot_scanner.py:99-106
Vulnerability Type: Arbitrary API endpoint configuration causing credential disclosure
Risk Level: Medium

Vulnerable Code

python

def get_client() -> OpenAI:
    api_key = os.environ.get("AISA_API_KEY")
    if not api_key:
        print("❌ Error: AISA_API_KEY environment variable is not set.", file=sys.stderr)
        print("   Set it with: export AISA_API_KEY=your_key_here", file=sys.stderr)
        sys.exit(1)
    base_url = os.environ.get("AISA_BASE_URL", "https://api.aisa.one/v1")
    return OpenAI(api_key=api_key, base_url=base_url)

Technical Analysis

Network access and use of AISA_API_KEY are necessary for the Skill's declared market-scanning functionality. However, the code permits AISA_BASE_URL to select an arbitrary API server without validating its scheme or hostname.

The OpenAI-compatible client authenticates requests using the supplied API key. Consequently, changing AISA_BASE_URL redirects credential-bearing requests away from the declared AISA service. An attacker who can influence the process environment can cause the Skill to disclose the AISA credential to an attacker-controlled endpoint.

This configurability exceeds the minimum privilege required to communicate with the declared service because the production credential does not need to be transmitted to arbitrary hosts.

Attack Path

1. An attacker gains influence over the environment used to launch the Skill, such as a deployment configuration, shell profile, wrapper script, or environment file.
2. The attacker sets AISA_BASE_URL to an HTTPS endpoint under their control.
3. A user invokes scripts/hot_scanner.py with a valid AISA_API_KEY.
4. get_client() constructs the client using the attacker-controlled base URL and the legitimate API key.
5. The scanner makes a chat-completion request to the attacker's server and includes a ...[truncated 643 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the AISA_BASE_URL override if custom endpoints are not an essential supported feature:

   python

   return OpenAI(
       api_key=api_key,
       base_url="https://api.aisa.one/v1",
   )
   

2. If endpoint customization is required, parse the URL and enforce:
   • An https scheme.
   • An explicit allowlist of trusted hostnames.
   • No embedded user information.
   • An approved port.
3. Use separate, restricted credentials for development or testing endpoints rather than forwarding the production AISA key.
4. Document the endpoint configuration and its credential-disclosure implications.
5. Apply least-privilege API scopes, usage limits, credential rotation, and monitoring for suspicious key use.
6. Avoid including authorization headers or secrets in errors, diagnostics, or request logs.

T08 · Insecure Dependencies

Note

• Location: scripts/hot_scanner.py:4

Finding

Unbounded Runtime Dependency Resolution

Content

View full analysis

Vulnerability Details

File Location: scripts/hot_scanner.py:4-7
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code

python

# dependencies = [
#     "openai>=1.0.0",
# ]

Technical Analysis

The inline dependency declaration accepts every future openai package release at or above version 1.0.0. When the documented uv run execution path resolves this dependency, the installed version may therefore differ across executions and environments.

No typo-squatted package or currently malicious release was identified. The risk arises from the open-ended constraint: a future compromised, incompatible, or unexpectedly changed release would be eligible for automatic installation. The dependency runs in the scanner process and can access its environment, including AISA_API_KEY.

Attack Path

1. A user invokes the script through the documented uv run workflow in an environment without a locked dependency version.
2. The package resolver queries its configured package source and selects any available openai version satisfying >=1.0.0.
3. A future compromised or otherwise unsafe eligible release is downloaded and installed.
4. The dependency is imported by the scanner and executes within the Skill process.
5. Malicious dependency code could read AISA_API_KEY, modify API requests or responses, access files available to the invoking user, or perform network operations with that user's privileges.

Exploitation depends on compromise of an eligible dependency release or package source; the audited project does not itself establish that such a compromise has occurred.

Impact Assessment

A compromised dependency would execute with the same operating-system privileges as the user running the Skill. It could access the scanner's environment variables, including AISA_API_KEY, and any files or network resources available to that process.

The practical ...[truncated 255 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact reviewed version rather than using an open-ended minimum:

   python

   # dependencies = [
   #     "openai==REVIEWED_VERSION",
   # ]
   

2. Generate and commit a lock file containing exact transitive dependency versions.
3. Use package hashes or another integrity-verification mechanism where supported.
4. Configure dependency resolution to use a trusted package index over TLS.
5. Review and test upgrades before changing the pinned version.
6. Add automated dependency vulnerability and provenance checks to the release process.
7. Run the Skill with only the environment variables and filesystem permissions it requires.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill declares access to an environment variable (AISA_API_KEY) and invokes local code, but it does not define an explicit tool scope such as permissions or allowed-tools. This can lead to overbroad execution privileges or ambiguous runtime behavior, increasing the risk that the skill accesses resources beyond what is necessary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger language is broad enough to match many ordinary market-related requests, which can cause unintended invocation of the skill. If auto-invoked, the skill may send user prompts or API-backed requests to an external market-scanning service without the user clearly intending that action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill does not clearly warn users that their request content may be transmitted to an external service and that the skill relies on a system-held API key. This creates a privacy and transparency risk because users may unknowingly cause externally processed requests when asking general market questions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest sets "language": "zh", which is a natural-language locale constraint. In this file there is no accompanying indication that the user can choose another language or that the Chinese-only behavior is an explicitly documented, justified regional limitation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

The script transmits data and credentials to an external service endpoint, and the destination can be overridden via the AISA_BASE_URL environment variable without validation. If an attacker can influence the environment, requests containing the API key and user-supplied market queries could be redirected to an untrusted server, causing credential leakage and unintended data disclosure.

Content

Scanner excerpt · scripts/hot_scanner.py (reported line 125)May include surrounding context.

python

print("❌ Error: AISA_API_KEY environment variable is not set.", file=sys.stderr)
        print("   Set it with: export AISA_API_KEY=your_key_here", file=sys.stderr)
        sys.exit(1)
    base_url = os.environ.get("AISA_BASE_URL", "https://api.aisa.one/v1")
    return OpenAI(api_key=api_key, base_url=base_url)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code reads an API key from the environment and configures a client to send prompts to a remote AIsa/OpenAI-compatible endpoint. While the file documents its purpose at a high level, it does not explicitly warn users that their market-scanning prompt content will be transmitted to an external service using the configured credentials.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.