T08 · Insecure Dependencies
Warning
- Location
SKILL.md:28- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
全球财经早报 Global Market Briefing
Security checks for vulnerabilities and agentic risk
Overview
The skill appears purpose-aligned for generating a Chinese finance/news briefing, with some installation and data-integrity cautions but no evidence of deception, exfiltration, or unsafe persistence.
Install only if you are comfortable with a Chinese-language briefing tool that contacts China News and Tencent market-data endpoints and automatically writes dated Markdown reports to your Desktop. Prefer installing dependencies in a virtual environment with pinned versions, and avoid relying on the HTTP market data for financial decisions without verification.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/morning_briefing.py:54- Finding
Financial Market Data Retrieved over Plaintext HTTP
- Content
View full analysis
32 and f[3]: pct = float(f[32]) arrow = '🟢' if pct > 0 else '🔴' items.append({'name': f[1], 'price': f[3], 'pct': pct, 'arrow': arrow}) ``` An attacker can construct a syntactically valid response containing forged index names, prices, and percentage changes. Those values are then inserted into the generated Markdown file and printed briefing without source authentication or independent verification. ### Attack Path 1. The victim runs the briefing script on a network observable or controllable by an attacker. 2. The attacker performs traffic interception, DNS manipulation, gateway compromise, or another network redirection technique. 3. The attacker intercepts the request to `qt.gtimg.cn` or redirects it to an attacker-controlled server. 4. The attacker returns a response matching the expected tilde-delimited format, with at least 33 fields and attacker-selected market values. 5. The script accepts and parses the forged response. 6. The manipulated index data is saved to `~/Desktop/早间新闻/morning_briefing_YYYY-MM-DD.md` and included in standard output. ### Impact Assessment The vulnerability allows modification of the displayed financial-market data and ...[truncated 447 chars]- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared purpose understates behavior by omitting significant local file writes and by overselling the source coverage as 'global news' when it is actually a fixed set of RSS feeds. This mismatch is dangerous because users and policy systems may approve the skill under false assumptions, while the skill also produces additional output artifacts beyond the advertised Markdown briefing.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documents network access and local file creation but does not declare any explicit tool scope or permissions, which weakens containment and informed consent. In agent environments, undeclared capabilities can lead to broader-than-expected execution, especially when the scheduled example explicitly enables exec for a script that fetches remote content and writes files.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The natural-language description and generated user-facing content are fixed in Chinese, which can violate language or locale policy when no user opt-in or choice is provided. There is no indication in the file that the skill is region-specific by design or that users can select another language.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script always creates the Desktop output directory and writes the full markdown report before checking whether --stdout was requested. This violates the apparent contract of stdout-only mode and can cause unintended local data persistence, which matters because the report contains externally sourced content and links that a user may have expected not to be stored.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This file presents the skill's instructions and behavior in Chinese without indicating that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking or China-specific audience.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file applies to SQP-2, and it explicitly states that a full Markdown report is stored locally. While the behavior is mentioned, there is no clear user-facing warning or caution about automatic file creation, persistence, or where data will be stored, which could affect user data management expectations.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The script writes a generated report to a Desktop path in the user's home directory without prompting, opt-in, or a clearly advertised side effect at runtime. While not a code-execution issue, unexpected writes can expose sensitive browsing/interests metadata, create clutter, and violate least-surprise expectations for an agent skill.
- Content