T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/monitor.py:127- Finding
Monitoring and portfolio identifiers are transmitted over plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
小智A股分析引擎
Security checks for vulnerabilities and agentic risk
Overview
This stock-analysis skill mostly does what it claims, but it needs review because it stores watchlist data locally, uses insecure market-data transport, and gives investment-oriented signals.
Review this before installing. Use it only for informational stock analysis, not as personalized financial advice. Be aware that watchlists, cost basis, alert state, logs, and saved reports may be written locally, and stock identifiers may be sent to market-data providers over plaintext HTTP. Avoid the optional pip installs unless you verify and pin the packages yourself, and only enable cron, WeChat, or DingTalk-style alerts with explicit destinations you control.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:565- Finding
Optional third-party dependencies are installed without version or integrity pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (27)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
This finding highlights unsupported claims around alerting, stock-pool management, sentiment, quantitative selection, multi-source fusion, and cross-market coverage. Even if not directly exploitable as code injection, deceptive capability framing weakens security review and can cause dangerous trust decisions, especially in an agent ecosystem where metadata drives invocation and privileges.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This finding highlights unsupported claims around alerting, stock-pool management, sentiment, quantitative selection, multi-source fusion, and cross-market coverage. Even if not directly exploitable as code injection, deceptive capability framing weakens security review and can cause dangerous trust decisions, especially in an agent ecosystem where metadata drives invocation and privileges.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
This finding highlights unsupported claims around alerting, stock-pool management, sentiment, quantitative selection, multi-source fusion, and cross-market coverage. Even if not directly exploitable as code injection, deceptive capability framing weakens security review and can cause dangerous trust decisions, especially in an agent ecosystem where metadata drives invocation and privileges.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
This finding highlights unsupported claims around alerting, stock-pool management, sentiment, quantitative selection, multi-source fusion, and cross-market coverage. Even if not directly exploitable as code injection, deceptive capability framing weakens security review and can cause dangerous trust decisions, especially in an agent ecosystem where metadata drives invocation and privileges.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases are broad, natural-language stock questions such as '今天大盘怎么样' and '有什么好股推荐', which are likely to appear in ordinary conversation and can cause unintended invocation. In an investment-advice skill, accidental activation is more sensitive because it may lead the agent to produce financial recommendations or fetch external market data when the user did not explicitly intend to use this skill.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises and documents capabilities that involve network access, reading and writing local files, and possibly environment access, but it does not declare any explicit tool scope or permission boundary. In an agent setting, missing scope declarations can cause over-broad tool availability and make unintended file modification, data exfiltration, or network actions easier if the skill is invoked in the wrong context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger priority and activation scope are broad enough to match many ordinary stock-related conversations. Overly broad triggers are dangerous in agent systems because they increase unintended invocation, which can lead to unnecessary tool use, network access, file writes, or autonomous actions in contexts where the user did not actually request this skill.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The example phrases are conversational and ambiguous, lacking scope constraints or negative examples, so the skill may activate on casual mentions like 'xx怎么看' or '查一下xx'. In this skill's context, that is more dangerous because the documented behavior includes network retrieval, local persistence, monitoring, and outbound alerts, making accidental activation more consequential than for a purely static skill.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation adds outbound push-notification channels such as WeChat and DingTalk, which extend the skill from passive analysis into active external communication. Outbound messaging materially increases risk because it can be abused for data exfiltration, spam, social engineering, or unauthorized alerting, especially if combined with monitoring and local state.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The document title and all instructional content are written exclusively in Chinese, with no indication that the user can choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This document provides explicit buy/sell timing signals such as '买入', '离场', and '最佳买点' without any accompanying risk disclosure, suitability warning, or statement that the material is not investment advice. In the context of a stock-analysis skill that outputs trading guidance, this can cause users to rely on the signals as actionable financial advice and make risky decisions without understanding uncertainty or loss potential.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Natural-language strings throughout the script, including the module docstring, markdown output, and CLI description/help text, are fixed in Chinese. The file provides no option for users to select another language or explicitly opt into Chinese-only output, which conflicts with the language/locale choice requirement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This codebase uses Chinese-only natural-language descriptions and user-facing output, and also sets the HTTP Accept-Language header to zh-CN. Under the policy rule, forcing a specific language/locale without user opt-in is a natural-language policy violation unless the restriction is clearly justified or optional.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The module docstring and all user-facing descriptions are written exclusively in Chinese and present the skill as '小智实时监控预警' without any indication that another language can be selected. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script creates a workspace directory and persists configuration, monitoring state, and logs to local files, then later modifies them via save_config, save_state, and log_event. Although the code performs visible writes, there is no docstring, comment, or user-facing notice near these operations warning that user data and monitoring history will be stored on disk.
- Content
Tainted flow: 'LOG_FILE' from os.environ.get (line 40, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python def log_event(event: dict): event["ts"] = datetime.now().isoformat() with open(LOG_FILE, "a", encoding="utf-8") as f: f.write(json.dumps(event, ensure_ascii=False) + "\n") # ========================================
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest and module docstring frame this skill as a market analysis and real-time monitoring/alert capability, but the CLI also performs local stateful management actions such as adding/removing stocks and setting holding costs. Those are not just implementation details of alerting output; they extend the behavior into persistent portfolio/watchlist administration by writing configuration data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
All scenarios, prompts, expected output types, and verification requirements are written exclusively in Chinese, and the file does not indicate that language selection is optional. This can amount to a locale/language policy issue because it implicitly forces a specific language without documented user choice or justification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The prompt "推荐几只股票" is a very broad natural-language trigger for investment recommendations and can activate the skill in situations where the user did not intend a regulated or high-risk advisory workflow. In a stock-analysis skill, unintended activation is more dangerous because the output can influence financial decisions, increasing the chance of inappropriate or overconfident recommendations being delivered without sufficient suitability checks or context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The portfolio-review prompt "帮我看看我的股票池" is ambiguous because it implies access to holdings or a watchlist without specifying what input the user must provide. In this financial context, ambiguous activation can lead the agent to infer, fabricate, or overreach about portfolio state, which is risky because users may rely on unsupported portfolio guidance as if it were personalized investment advice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The skill's natural-language interface, examples, and operating description all assume Chinese, but the file does not state that the skill is China-market-specific or offer users a language/locale choice. Under the policy, forcing a specific language without user opt-in can be a locale-policy issue unless the restriction is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This markdown file contains user-facing natural language exclusively in Chinese, including headings, descriptions, and usage guidance. Under the policy rule, forcing a specific language without user opt-in can be a locale-policy violation when no language choice or justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
All user-facing natural language in the file is in Chinese, and there is no indication that the user can choose another language or that the locale restriction is intentional and justified. Per SQP-3, forcing a specific language without user opt-in can violate language/locale policy.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code fetches index, sector, and stock data via helper functions, which implies outbound network access to external providers. Although the final markdown notes data sources, there is no warning before collection and no inline disclosure in the code comments/docstrings that running the script will contact third-party services.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest describes capabilities such as real-time行情查询、分析、策略输出、股票池管理和监控预警, but this script also writes full JSON/Markdown reports into a local "memory" directory for later use. Persistent report storage is not clearly stated in the manifest's description of an analysis engine and goes beyond transient query/response behavior.
- Content