Finance Analysis

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:30 AM UTC
• Version: 1.0.0

Overview

This finance skill does not show malware behavior, but its valuation and risk commands can present fixed demo numbers as stock-specific investment analysis.

Review before installing. Treat the valuation and risk outputs as illustrative only unless the publisher replaces the fixed values with sourced, stock-specific calculations and adds clear non-advice disclaimers. Pin Python dependencies and understand that enabling TUSHARE_TOKEN may send queried stock symbols to Tushare.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

other

Error

• Location: scripts/finance_analysis.py:121
• Finding: Hardcoded Financial Results Are Presented as Stock-Specific Analysis<![CDATA[ ## Vulnerability Details **File Location**: `scripts/finance_analysis.py:121-181` **Vulnerability Type**: Misleading financial output and data-integrity failure **Risk Level**: High ### Vulnerable Code ```python def valuation_dcf(stock_code): """DCF 估值""" print_header(f"💰 DCF 估值 - {stock_code}") # 简化版 DCF 估值示例 print(f"{Colors.BOLD}【假设条件】{Colors.ENDC}") print("最新收入：¥100,000 百万（示例数据）") print("收入增长率：15.0%") print("净利润率：50.0%") print("WACC：8.0%") print("永续增长率：2.0%") print("预测年限：5 年") print(f"\n{Colors.BOLD}【估值结果】{Colors.ENDC}") print("预测期现金流现值：¥278,262 百万") print("终值现值：¥1,603,225 百万") print(f"{Colors.OKGREEN}公司价值：¥1,881,487 百万{Colors.ENDC}") print(f"{Colors.OKGREEN}每股价值：¥1,498 元{Colors.ENDC}") print_success("DCF 估值完成！") def valuation_relative(stock_code): """相对估值""" print_header(f"💰 相对估值 - {stock_code}") print(f"{Colors.BOLD}【估值倍数】{Colors.ENDC}") print("指标 公司 行业平均 溢价/折价") print("--------------------------------------------------") print("PE (市盈率) 35.0x 20.0x +75.0%") print("PB (市净率) 12.0x 8.0x +50.0%") print("PS (市销率) 15.0x 10.0x +50.0%") print(f"\n{Colors.BOLD}【综合评估】{Colors.ENDC}") print(f"{Colors.WARNING}估值偏高：+58.3%{Colors.ENDC}") print("建议：谨慎买入或等待回调") print_success("相对估值完成！") def risk_assessment(stock_code): """风险评估""" print_header(f"⚠️ 风险评估 - {stock_code}") print(f"{Colors.BOLD}【偿债能力】{Colors.ENDC}") print(f"流动比率：2.50 {Colors.OKGREEN}✅ 良好{Colors.ENDC}") print(f"速动比率：2.00 {Colors.OKGREEN}✅ 良好{Colors.ENDC}") print(f"资产负债率：30.0% {Colors.OKGREEN}✅ 良好{Colors.ENDC}") print(f"\n{Colors.BOLD}【盈利能力】{Colors.ENDC}") print(f"ROE：30.0% {Colors.OKGREEN}✅ 强{Colors.ENDC}") print(f"\n{Colors.BOLD}【成长能力】{Colors.ENDC}") print(f"收入增长率：18.0% {Colors.OKGREEN}✅ 高增长{Colors.ENDC}") print( ...[truncated 2214 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace all fixed results with calculations based on validated, stock-specific data. 2. Retrieve and verify the required revenue, cash-flow, debt, share-count, valuation-multiple, and risk-ratio inputs before generating a result. 3. Include the source, reporting period, retrieval timestamp, and units for every input. 4. If the functions are intended only as demonstrations, rename them accordingly and print an unavoidable warning such as: ```text DEMONSTRATION ONLY — NOT STOCK-SPECIFIC AND NOT INVESTMENT ADVICE ``` 5. Require explicit numerical inputs when reliable market data is unavailable rather than silently substituting examples. 6. Prevent investment recommendations from being emitted when data is missing, stale, incomplete, or demonstrative. 7. Add tests proving that different stock inputs either produce independently sourced results or fail safely. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/finance_analysis.py:56
• Finding: Unsanitized Stock Codes Permit Terminal Escape-Sequence Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/finance_analysis.py:56`, with equivalent sinks at lines 124, 145, and 161; additional equivalent sinks occur in `scripts/valuation.py:58,128,178` **Vulnerability Type**: Terminal control-sequence injection **Risk Level**: Medium ### Vulnerable Code ```python def analyze_finance(stock_code): """分析财报""" print_header(f"📊 财报分析 - {stock_code}") ``` The same unsafe interpolation pattern is used by the other commands: ```python def valuation_dcf(stock_code): """DCF 估值""" print_header(f"💰 DCF 估值 - {stock_code}") def valuation_relative(stock_code): """相对估值""" print_header(f"💰 相对估值 - {stock_code}") def risk_assessment(stock_code): """风险评估""" print_header(f"⚠️ 风险评估 - {stock_code}") ``` The CLI accepts the value as an unrestricted string: ```python analyze_parser.add_argument('--stock', type=str, required=True, help='股票代码') val_parser.add_argument('--stock', type=str, required=True, help='股票代码') risk_parser.add_argument('--stock', type=str, required=True, help='股票代码') ``` ### Technical Analysis The `--stock` argument is accepted as an arbitrary string and interpolated directly into ANSI-capable terminal output. No stock-code allowlist, control-character filtering, escaping, or output encoding is applied. A malicious value can contain C0/C1 control characters, including ESC-prefixed ANSI or OSC sequences. Depending on terminal capabilities and policy, these sequences can: - Clear or rewrite visible terminal content. - Reposition the cursor and forge subsequent output. - Change terminal titles. - Display deceptive hyperlinks. - Conceal warnings or make maliciously constructed text appear to be trusted program output. This is an output-injection issue rather than shell command injection: the value is not passed to a shell, but it is interpreted by the terminal emulator. ### Attack Path 1. An attacker provides or recommends a crafted stock argument containing termina ...[truncated 1128 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate stock codes against a strict allowlist before any API call or output operation. For the documented market formats, use a pattern such as: ```python import re STOCK_CODE_RE = re.compile(r"^[0-9]{6}\.(SZ|SH|BJ)$") def validate_stock_code(value): value = value.upper() if not STOCK_CODE_RE.fullmatch(value): raise argparse.ArgumentTypeError("Invalid stock code") return value ``` 2. Apply the validator through `argparse`: ```python analyze_parser.add_argument("--stock", type=validate_stock_code, required=True) ``` 3. As defense in depth, remove all C0 and C1 control characters from any untrusted value before terminal output. 4. Apply the same validation to independently callable functions in `scripts/valuation.py`. 5. When logging arbitrary external API fields, use a safe representation or sanitizer rather than writing raw text to an ANSI-capable terminal. 6. Add tests covering ESC, OSC, newline, carriage-return, backspace, and Unicode control-character payloads. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:116
• Finding: Python Installation Instructions Use Unpinned Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:116-120`; the same unsafe installation command is documented in `README.md:105-109` **Vulnerability Type**: Non-reproducible and mutable dependency resolution **Risk Level**: Medium ### Vulnerable Code ```bash pip install tushare pandas numpy ``` Although `package.json` lists versions, pip does not use npm package metadata to resolve Python dependencies: ```json "dependencies": { "tushare": "1.2.88", "pandas": "1.5.3", "numpy": "1.23.5" } ``` ### Technical Analysis The documented installation command asks pip to resolve the latest available releases of three third-party packages. It does not specify exact versions, hashes, an index policy, or a locked transitive dependency graph. The versions in `package.json` do not secure the Python installation because pip does not read that dependency section. Consequently, users following the documented setup receive mutable dependency versions that may differ from those reviewed or expected by the project. The audit found no evidence that the named packages are malicious. The vulnerability is the unsafe dependency-management process: a future compromised release, account takeover, malicious transitive dependency, or incompatible update could be installed without a corresponding change to this repository. ### Attack Path 1. A user follows the installation instructions in `SKILL.md` or `README.md`. 2. Pip queries the configured package index and resolves the current versions and transitive dependencies. 3. Those artifacts may differ from the versions originally tested or reviewed. 4. If an upstream artifact or dependency is compromised, its installation or imported runtime code executes in the Python environment. 5. That code obtains the permissions of the user running pip or the financial-analysis program. This path depends on an upstream supply-chain compromise or unsafe package-index configuration; no such compromise was established during th ...[truncated 560 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a Python-native lock or requirements file containing exact versions for direct and transitive dependencies. 2. Record trusted hashes and require hash verification: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Generate and review the lock file with a reproducible dependency-management tool. 4. Update both `SKILL.md` and `README.md` so users install only from the reviewed lock file. 5. Configure an explicit trusted package index and avoid fallback to untrusted or organization-internal indexes with ambiguous package names. 6. Run dependency vulnerability and provenance checks in CI. 7. Review dependency updates before regenerating hashes and publishing a new Skill version. 8. Do not rely on `package.json` to manage Python dependencies; use Python packaging metadata or a Python lock file. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The natural-language content of the skill, including its description and usage instructions, is presented only in Chinese. This can violate a language/locale policy when the skill effectively forces a specific language without offering the user an explicit choice or documenting that the skill is region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This code file contains natural-language strings that establish a fixed language/locale for the skill experience. Under the policy, forcing a specific language without offering the user a choice is a natural-language policy violation unless clearly justified as region-specific.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The DCF valuation function presents itself as a stock-specific valuation tool but emits hard-coded example assumptions and results regardless of the provided stock code. In a finance-analysis skill, this is dangerous because users may rely on fabricated outputs for investment decisions, creating integrity and trust risks even without code execution or data exfiltration.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The relative valuation command claims to assess the specified stock but only prints a static multiples table and a fixed recommendation. In the context of a finance CLI, this can mislead users into believing the result is data-driven, which is a harmful integrity flaw because the recommendation is detached from the actual asset analyzed.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The risk assessment feature outputs fixed metrics, score, and 'low risk' language without evaluating the input stock. In a financial decision-support skill, this is particularly dangerous because it can create false assurance about risk and directly influence user behavior based on fabricated analysis.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The function emits explicit investment recommendations such as '可以买入', '值得买入', and '强烈买入' without any disclaimer that the output is simplified, informational only, and not financial advice. In a finance-analysis skill, users may reasonably rely on these statements for real financial decisions, increasing the risk of harmful overtrust even though there is no code-execution or data-exfiltration component.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: SQP-3 applies to natural-language policy issues in all file types. Nearly all user-facing instructions and descriptions are in Chinese, and the document does not indicate that the skill is region-specific or provide any opt-in or alternative language, which can amount to a forced language/locale choice.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: This is a markdown file, so SQP-2 applies to omissions in user-facing warnings. The README introduces `TUSHARE_TOKEN` for Tushare API access, which implies network calls to an external service, but it does not warn users that stock queries and related usage data may be sent to that provider.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: This manifest uses Chinese-only natural-language fields such as the description, author name, and tags, with no indication that the skill supports other languages or that the user can choose a locale. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: User-facing docstrings, headers, labels, and recommendations throughout the file are written exclusively in Chinese, which imposes a fixed language/locale on users. The policy allows locale constraints when they are justified or optional, but this file does not provide language selection or explain that it is intentionally region-specific.

Static analysis

No suspicious patterns detected.