Security audit

PythonGO

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent PythonGO help skill, but it includes trading and backtesting material that can place orders or process remote files, so users should review it carefully before use.

Install only if you specifically want PythonGO trading/backtesting help. Treat generated strategy code as capable of real financial action: test in simulation first, verify exchange and contract fields, protect access keys, and do not run examples that place or cancel orders until you have reviewed them. Avoid downloading and importing remote Python files without integrity checks, and do not run the bundled backtesting ZIP-download path against untrusted data sources unless the extraction bug is fixed.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: codebase/pythongo/backtesting/tools.py:21
Finding: Unvalidated ZIP Extraction Permits Arbitrary File Writes
Content: View full analysis
Remediation: View remediation
None: root = Path(destination).resolve() for member in zip_file.infolist(): target = (root / member.filename).resolve() try: target.relative_to(root) except ValueError: raise ValueError(f"Unsafe ZIP member path: {member.filename}") if member.filename.startswith(("/", "\\")): raise ValueError(f"Absolute ZIP member path rejected: {member.filename}") zip_file.extract(member, root) ``` 2. Reject drive-qualified paths, `..` traversal components, absolute paths, symbolic links, and other special archive entries. 3. Require HTTPS and allowlist the expected download hostname. 4. Configure explicit connection and read timeouts. 5. Call `raise_for_status()` before processing the response. 6. Stream downloads and enforce compressed and decompressed size limits to prevent memory exhaustion and ZIP bombs. 7. Verify an authenticated checksum or digital signature supplied over a trusted channel. 8. Extract into a newly created private temporary directory first, validate the expected file structure and names, and only then move approved files into the cache. 9. Use a `with` statement for both the HTTP response and `ZipFile` so resources are reliably released on failure. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

Location: docs_normalized/examples.md:452
Finding: Documentation Directs Users to Download and Import Mutable Remote Python Code
Content: View full analysis
None: super().on_start() ma5 = MA(self.kline_generator.producer.close, 5) # 获取 5 日均线序列 ma10 = MA(self.kline_generator.producer.close, 10) # 获取 10 日均线序列 ``` ``` The same guidance is also represented in the generated documentation index at `docs_indexed/examples.json`. ### Technical Analysis The documentation instructs users to download a live Python source file from an external URL, place it directly in the strategy import path, and import it as `MyTT`. Python executes module-level statements during import, so the downloaded file is an executable payload rather than passive data. The instructions do not provide: - An immutable release or commit reference - A cryptographic checksum - A digital signature - A bundled, reviewed copy of the module - A requirement to inspect the downloaded source before importing it Consequently, the effective payload can change after the Skill package has been reviewed. Compromise of the hosting endpoint, content publication account, or distribution process could turn the documented workflow into arbitrary code execution. ### Attack Path 1. An attacker compromises the remote file, its hosting infrastructure, or an account authorized to publish it. 2. The attacker inserts malicious module-level Python code into `MyTT.py`. 3. A user follows the bundled documentation and downloads the current remote file. 4. The user places it in the `pyStrategy` import path. 5. A strategy executes `from MyTT import MA` ...[truncated 802 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (151)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill specification explicitly normalizes use of bundled file resources and references an external web documentation location, yet it declares itself as a documentation/Q&A helper without disclosing any permission model. If the underlying implementation also performs outbound network access and local file writes as the finding suggests, packaging that under a low-risk help skill materially increases the chance of covert data access, data exfiltration, or supply-chain abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill specification explicitly normalizes use of bundled file resources and references an external web documentation location, yet it declares itself as a documentation/Q&A helper without disclosing any permission model. If the underlying implementation also performs outbound network access and local file writes as the finding suggests, packaging that under a low-risk help skill materially increases the chance of covert data access, data exfiltration, or supply-chain abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill specification explicitly normalizes use of bundled file resources and references an external web documentation location, yet it declares itself as a documentation/Q&A helper without disclosing any permission model. If the underlying implementation also performs outbound network access and local file writes as the finding suggests, packaging that under a low-risk help skill materially increases the chance of covert data access, data exfiltration, or supply-chain abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill specification explicitly normalizes use of bundled file resources and references an external web documentation location, yet it declares itself as a documentation/Q&A helper without disclosing any permission model. If the underlying implementation also performs outbound network access and local file writes as the finding suggests, packaging that under a low-risk help skill materially increases the chance of covert data access, data exfiltration, or supply-chain abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill specification explicitly normalizes use of bundled file resources and references an external web documentation location, yet it declares itself as a documentation/Q&A helper without disclosing any permission model. If the underlying implementation also performs outbound network access and local file writes as the finding suggests, packaging that under a low-risk help skill materially increases the chance of covert data access, data exfiltration, or supply-chain abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill specification explicitly normalizes use of bundled file resources and references an external web documentation location, yet it declares itself as a documentation/Q&A helper without disclosing any permission model. If the underlying implementation also performs outbound network access and local file writes as the finding suggests, packaging that under a low-risk help skill materially increases the chance of covert data access, data exfiltration, or supply-chain abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill specification explicitly normalizes use of bundled file resources and references an external web documentation location, yet it declares itself as a documentation/Q&A helper without disclosing any permission model. If the underlying implementation also performs outbound network access and local file writes as the finding suggests, packaging that under a low-risk help skill materially increases the chance of covert data access, data exfiltration, or supply-chain abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill specification explicitly normalizes use of bundled file resources and references an external web documentation location, yet it declares itself as a documentation/Q&A helper without disclosing any permission model. If the underlying implementation also performs outbound network access and local file writes as the finding suggests, packaging that under a low-risk help skill materially increases the chance of covert data access, data exfiltration, or supply-chain abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill specification explicitly normalizes use of bundled file resources and references an external web documentation location, yet it declares itself as a documentation/Q&A helper without disclosing any permission model. If the underlying implementation also performs outbound network access and local file writes as the finding suggests, packaging that under a low-risk help skill materially increases the chance of covert data access, data exfiltration, or supply-chain abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill specification explicitly normalizes use of bundled file resources and references an external web documentation location, yet it declares itself as a documentation/Q&A helper without disclosing any permission model. If the underlying implementation also performs outbound network access and local file writes as the finding suggests, packaging that under a low-risk help skill materially increases the chance of covert data access, data exfiltration, or supply-chain abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill specification explicitly normalizes use of bundled file resources and references an external web documentation location, yet it declares itself as a documentation/Q&A helper without disclosing any permission model. If the underlying implementation also performs outbound network access and local file writes as the finding suggests, packaging that under a low-risk help skill materially increases the chance of covert data access, data exfiltration, or supply-chain abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill specification explicitly normalizes use of bundled file resources and references an external web documentation location, yet it declares itself as a documentation/Q&A helper without disclosing any permission model. If the underlying implementation also performs outbound network access and local file writes as the finding suggests, packaging that under a low-risk help skill materially increases the chance of covert data access, data exfiltration, or supply-chain abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill specification explicitly normalizes use of bundled file resources and references an external web documentation location, yet it declares itself as a documentation/Q&A helper without disclosing any permission model. If the underlying implementation also performs outbound network access and local file writes as the finding suggests, packaging that under a low-risk help skill materially increases the chance of covert data access, data exfiltration, or supply-chain abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill specification explicitly normalizes use of bundled file resources and references an external web documentation location, yet it declares itself as a documentation/Q&A helper without disclosing any permission model. If the underlying implementation also performs outbound network access and local file writes as the finding suggests, packaging that under a low-risk help skill materially increases the chance of covert data access, data exfiltration, or supply-chain abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill specification explicitly normalizes use of bundled file resources and references an external web documentation location, yet it declares itself as a documentation/Q&A helper without disclosing any permission model. If the underlying implementation also performs outbound network access and local file writes as the finding suggests, packaging that under a low-risk help skill materially increases the chance of covert data access, data exfiltration, or supply-chain abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill specification explicitly normalizes use of bundled file resources and references an external web documentation location, yet it declares itself as a documentation/Q&A helper without disclosing any permission model. If the underlying implementation also performs outbound network access and local file writes as the finding suggests, packaging that under a low-risk help skill materially increases the chance of covert data access, data exfiltration, or supply-chain abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill specification explicitly normalizes use of bundled file resources and references an external web documentation location, yet it declares itself as a documentation/Q&A helper without disclosing any permission model. If the underlying implementation also performs outbound network access and local file writes as the finding suggests, packaging that under a low-risk help skill materially increases the chance of covert data access, data exfiltration, or supply-chain abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill specification explicitly normalizes use of bundled file resources and references an external web documentation location, yet it declares itself as a documentation/Q&A helper without disclosing any permission model. If the underlying implementation also performs outbound network access and local file writes as the finding suggests, packaging that under a low-risk help skill materially increases the chance of covert data access, data exfiltration, or supply-chain abuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill specification explicitly normalizes use of bundled file resources and references an external web documentation location, yet it declares itself as a documentation/Q&A helper without disclosing any permission model. If the underlying implementation also performs outbound network access and local file writes as the finding suggests, packaging that under a low-risk help skill materially increases the chance of covert data access, data exfiltration, or supply-chain abuse.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The strategy contains active trading primitives that cancel existing orders and place new buy/sell orders automatically based on computed signals. In a skill whose stated purpose is to answer questions about code and documentation, bundling executable live-trading behavior increases risk because an agent or user could invoke or adapt it for real market actions without adequate safeguards, confirmation, or sandboxing.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The backtesting engine initializes a MarketCenter client with access credentials and later uses it to retrieve market and tick data, which is a capability far beyond the stated skill purpose of answering questions about code and docs. In an agent-skill context, unexpected network access materially increases risk because a user invoking a documentation helper would not reasonably expect external API usage or data retrieval side effects.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code downloads remote tick-data archives and writes them into a local cache directory, creating filesystem side effects not aligned with the manifest's Q&A-only description. Hidden download-and-write behavior is dangerous in agent environments because it can consume disk, persist data unexpectedly, and expand the trust boundary to remote content.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · codebase/pythongo/backtesting/models.py (reported line 20)May include surrounding context.
python
"""Access Key""" access_secret: str """Access Secret""" fee_rate: float = 0.0023 """手续费率"""

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The function imports a module from an arbitrary file path and executes it via spec.loader.exec_module(module), which runs the file's top-level Python code immediately. In a skill described as a Q&A/documentation assistant, this capability is unnecessary and materially increases risk because any attacker-controlled or unexpected local file could achieve arbitrary code execution in the agent environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This tutorial instructs users to build a strategy that immediately places a live order in on_start() using UI-provided parameters, without any safety interlock, simulation-only guard, confirmation step, or warning about financial consequences. In a trading skill context, this is operationally dangerous because a user can trigger real market activity simply by starting the strategy, potentially causing unintended trades and losses.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.