Mx Macro Data

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:01 AM UTC
• Version: 0.1.0

Overview

This skill coherently queries Eastmoney macroeconomic data and writes CSV outputs, with expected but nonzero risks around third-party query sharing and spreadsheet-safe CSV handling.

Install only if you are comfortable sending query text to Eastmoney's service with your EM_API_KEY. Treat generated CSVs as data from a remote source: avoid opening them with spreadsheet security protections disabled, and prefer reviewing or sanitizing files before use in Excel-like tools.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/get_data.py:74

Finding

Spreadsheet Formula Injection in Generated CSV Files

Content

View full analysis

Vulnerability Details

File Location: scripts/get_data.py, lines 74-83 and 242-281
Vulnerability Type: CSV/spreadsheet formula injection
Risk Level: Medium

Vulnerable Code:

python

def _flatten_value(v: Any) -> str:
    """
    Convert arbitrary cell values to strings.
    """
    if v is None:
        return ""
    if isinstance(v, (dict, list)):
        return json.dumps(v, ensure_ascii=False)
    return str(v)

python

fieldnames_set: Dict[str, None] = {}
for row in rows:
    for k in row:
        fieldnames_set[k] = None

priority_fields = ["entity_name", "indicator_name", "indicator_code", "frequency", "Data Source"]
fieldnames = []
for field in priority_fields:
    if field in fieldnames_set:
        fieldnames.append(field)
        del fieldnames_set[field]

date_fields = []
other_fields = []
for field in fieldnames_set.keys():
    if (field.isdigit() and len(field) == 4) or \
       (re.match(r'^\d{4}-\d{2}-\d{2}$', field)):
        date_fields.append(field)
    else:
        other_fields.append(field)

date_fields.sort(reverse=True)
other_fields.sort()

fieldnames.extend(other_fields)
fieldnames.extend(date_fields)

csv_path = output_dir / f"mx_macro_data_{unique_suffix}_{frequency}.csv"

with open(csv_path, "w", newline="", encoding="utf-8-sig") as f:
    writer = csv.DictWriter(f, fieldnames=fieldnames, extrasaction="ignore")
    writer.writeheader()
    for row in rows:
        writer.writerow({k: _flatten_value(v) for k, v in row.items()})

Technical Analysis

CSV column names and cell values derived from the remote API response are written without neutralizing spreadsheet formula prefixes. _flatten_value() converts values to strings but does not protect strings beginning with =, +, -, or @.

Spreadsheet applications can interpret such cells as formulas when a generated CSV file is opened. CSV quoting perfor ...[truncated 1696 chars]

Remediation

View remediation

Remediation Suggestions

• Introduce a dedicated CSV-sanitization function that detects strings whose first non-whitespace character is =, +, -, or @.
• Prefix potentially dangerous values with a single quote or another format-appropriate neutralization character before writing them.
• Apply sanitization to both cell values and remotely derived column names.
• Consider exporting to a format that supports explicit text cell types when files are primarily intended for spreadsheet applications.
• Document that generated files contain untrusted remote data and should not bypass spreadsheet security warnings.
• Add automated tests covering each dangerous prefix, leading whitespace, tabs, carriage returns, nested JSON values, and malicious header names.
• Preserve raw values separately only if required, and do not place unsanitized values into spreadsheet-interpreted cells.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:10

Finding

Unpinned Third-Party HTTP Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-16 and 168-174
Vulnerability Type: Unpinned runtime dependency and insufficient dependency integrity controls
Risk Level: Low

Vulnerable Code:

yaml

"install": [
  {
    "id": "pip-deps",
    "kind": "python",
    "package": "httpx",
    "label": "Install Python dependencies"
  }
]

bash

pip3 install httpx --user

Technical Analysis

The Skill installs httpx without a version constraint, lock file, or cryptographic hash. Consequently, installation resolves whichever package version and transitive dependencies are available from the configured Python package index at installation time.

This is not evidence that httpx itself is malicious. The weakness is that reviewed source behavior is not tied to a reproducible dependency set. A compromised package release, package index, local package-index configuration, or future incompatible release could introduce behavior that was not part of this audit.

Attack Path

1. An attacker compromises a relevant package release, a transitive dependency, the configured package index, or the dependency resolution path.
2. A user installs the Skill dependencies using pip3 install httpx --user or the equivalent metadata-driven installation.
3. Package resolution retrieves the attacker-controlled or unexpectedly changed artifact because no exact version or integrity hash is required.
4. The package is installed into the user's Python environment.
5. Malicious package initialization or runtime code executes with the privileges of the user running the installation or Skill.

Impact Assessment

If the dependency supply chain were compromised, injected code would run with the privileges of the installing or executing user. It could potentially read files and environment variables accessible to that account, including EM_API_KEY, make network requests, modify user-level fil ...[truncated 195 chars]

Remediation

View remediation

Remediation Suggestions

• Pin httpx to an exact, reviewed version rather than resolving the latest release.
• Maintain a lock file containing exact versions of all transitive dependencies.
• Use cryptographic package hashes and install with pip --require-hashes where supported.
• Retrieve dependencies only from an explicitly configured trusted package index over TLS.
• Periodically scan pinned dependencies for known vulnerabilities and update them through a reviewed process.
• Test dependency updates before changing the pinned versions.
• Keep dependency declarations in the installation metadata and documentation synchronized.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill requires an API key, performs network access, and writes files, but does not declare an explicit tool scope such as permissions or allowed-tools. This creates an overbroad execution surface where an orchestrator may grant more capabilities than intended, making secret exposure, unintended network access, or unsafe file writes harder to constrain and audit.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill sends the raw user query plus generated identifiers (callId and userId) to a third-party remote service without any visible consent, minimization, or privacy notice. Because natural-language queries may contain sensitive business or personal information, this creates an avoidable data disclosure risk to the external provider and to logs on either side.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The natural-language descriptions and examples specify Chinese-language querying and all user-facing output is in Chinese, but the file does not offer a language choice or document a justified locale restriction. This can violate language/locale policy when a skill implicitly requires one language without opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest frames the skill as a macroeconomic data query tool returning data and CSV output, but the code additionally depends on reading an environment variable credential (EM_API_KEY) at import time. Accessing host environment secrets is not described in the stated purpose and is a separate capability beyond the user-facing querying behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.