stock-watchlist-aisa

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:49 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent watchlist tool, but it needs review because an undocumented endpoint override can send the AISA API key and watchlist tickers to a non-AISA server.

Review this before installing if you rely on the AISA key for billing or account access. Use it only in an environment where AISA_BASE_URL is unset or explicitly trusted, assume watchlist tickers are sent to the configured AISA endpoint during checks, and treat generated BUY/HOLD/SELL signals as informational rather than financial advice.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/watchlist.py:51

Finding

Arbitrary API Endpoint Override Can Disclose the AISA API Key

Content

View full analysis

Vulnerability Details

File Location: scripts/watchlist.py, lines 51–57
Vulnerability Type: Unrestricted authenticated API endpoint configuration
Risk Level: Medium

python

def get_client() -> OpenAI:
    api_key = os.environ.get("AISA_API_KEY")
    if not api_key:
        print("❌ Error: AISA_API_KEY environment variable is not set.", file=sys.stderr)
        sys.exit(1)
    base_url = os.environ.get("AISA_BASE_URL", "https://api.aisa.one/v1")
    return OpenAI(api_key=api_key, base_url=base_url)

Technical Analysis

The code reads AISA_BASE_URL from the process environment without validating its scheme or hostname. It then creates an OpenAI client that uses AISA_API_KEY to authenticate requests to that endpoint.

The endpoint override may be useful in a controlled development environment, but unrestricted redirection is not necessary for the Skill's declared production functionality. A malicious or accidentally unsafe value can cause authenticated requests to be sent to an untrusted server. The code does not require HTTPS, enforce an approved-host allowlist, or prevent the production credential from being attached to custom endpoints.

When the check command runs, fetch_watchlist_data() submits the user's watchlist ticker symbols in a chat-completions request through this client. Therefore, the endpoint can receive both the authentication credential carried by the client and the submitted ticker data.

Attack Path

1. An attacker gains the ability to influence the Skill's runtime environment, deployment configuration, shell profile, or invocation wrapper.
2. The attacker sets AISA_BASE_URL to an endpoint under their control, such as https://attacker.example/v1.
3. The user or Agent invokes python3 scripts/watchlist.py check.
4. get_client() constructs an OpenAI client using the attacker-controlled base URL and the legitimate AISA_API_KEY.
5. fetch_watchlist_data() sends a chat-completions request containing t ...[truncated 909 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the AISA_BASE_URL override if alternate API endpoints are not required for the declared functionality.
2. If endpoint customization is necessary, parse the URL and require an approved scheme and hostname:
   • Require https.
   • Reject embedded credentials.
   • Allowlist trusted hosts such as api.aisa.one.
   • Reject loopback, link-local, private-network, and unapproved hosts where applicable.
3. Never automatically attach the production AISA_API_KEY to an arbitrary custom endpoint. Require a separate credential variable for development or custom endpoints.
4. Fail closed when URL validation fails and provide a clear error without printing credential material.
5. Document all permitted endpoints and explain that API requests disclose ticker data to the selected provider.
6. Use narrowly scoped, revocable API credentials and rotate any key suspected of having been exposed.
7. Validate the API response against a strict schema before using it for alerts, including ticker keys, numeric price fields, bounded RSI values, and an allowlist of signal values.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared purpose is a simple watchlist/alert skill, but the analysis indicates additional behaviors including external API use and generation of trading signals. This mismatch is dangerous because users and policy systems may approve the skill under a narrower trust model than what it actually does, enabling unexpected network egress, broader processing, and potentially risky financial guidance.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

## When NOT to Use

- Do not use this skill for browser-cookie extraction, passwords, Keychain access, or other local sensitive credential access.
- Prefer a different skill when the user request is outside this skill's domain.

## Capabilities

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill declares required environment variables and implies file read/write behavior, but does not define an explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where the effective capabilities are broader or less transparent than the manifest indicates, increasing the chance of unintended file access or secret exposure during execution.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/watchlist.py (reported line 60)May include surrounding context.

python

if not api_key:
        print("❌ Error: AISA_API_KEY environment variable is not set.", file=sys.stderr)
        sys.exit(1)
    base_url = os.environ.get("AISA_BASE_URL", "https://api.aisa.one/v1")
    return OpenAI(api_key=api_key, base_url=base_url)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest sets "language": "en", which expresses a fixed language choice in natural-language metadata. There is no accompanying indication that users can choose another language or that the English-only constraint is justified by a region-specific or compliance-bound purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.