T08 · Insecure Dependencies
Warning
- Location
SKILL.md:23- Finding
Unpinned Mutable Container Image Used as a Runtime Dependency
- Content
View full analysis
- Remediation
View remediation
Security audit
Maybe Finance - 个人财务助手
Security checks for vulnerabilities and agentic risk
Overview
The skill does not look like malware, but it should be reviewed because it asks for finance API credentials while the included CLI mostly returns mock data and can falsely report that transactions were added.
Review carefully before installing. Do not rely on this skill for real financial records unless the CLI is changed to clearly run in demo mode or to make verified Maybe API calls. If used, pin the Maybe container image, bind it only where intended, protect the API token, and require explicit confirmation or backups before any destructive account operation.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Warning
- Location
scripts/maybe-cli.py:119- Finding
Transaction Creation Reports Success Without Persisting Financial Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Tainted flow: 'req' from os.getenv (line 40, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python method=method ) with urllib.request.urlopen(req, timeout=30) as response: return json.loads(response.read().decode()) except urllib.error.HTTPError as e: print(f"Error: API request failed - {e.code} {e.reason}")
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documents use of environment variables for secrets and a self-hosted HTTP API, but it does not declare any explicit tool scope or permissions boundaries. That creates an authorization gap where an agent using the skill could access env/network capabilities more broadly than users expect, increasing the risk of secret exposure or unintended outbound requests in a finance context.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 81% confidence
- Finding
The deployment example pulls a container image using a mutable latest tag rather than a pinned version or digest. This creates a supply-chain risk because future pulls may retrieve unexpected or compromised code, which is especially sensitive for software handling financial data and API tokens.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill includes a destructive account deletion command with no warning, confirmation, backup guidance, or distinction between test and production use. In a personal finance system, accidental or automated deletion could cause irreversible data loss, broken reports, and loss of audit history.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring and manifest describe a personal finance management tool for the Maybe Finance self-hosted platform, implying real account, transaction, budget, and net worth operations. However, the command handlers at L72-L198 only print static mock datasets or echo user input, and the API helper defined at L25-L61 is never used.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code hard-codes Chinese labels such as account names and totals, and formats all values with the yuan symbol, while also presenting some headings in English. That constitutes a locale/language policy issue because users are not given any opt-in or configuration choice for language or regional formatting.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The docstring at L116 states that the function adds a new transaction, which implies a state-changing operation against the finance platform. In reality, the function just echoes the provided fields to stdout and performs no API call, storage update, or other persistence.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The usage examples hard-code Chinese text values such as "工资", "三月工资", and "餐饮" in a general-purpose skill description. Because the skill is not documented as China-specific and does not offer language choice, this creates a natural-language locale policy concern.
- Content