HuaHuaDailyMCP

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:53 AM UTC
• Version: 4.1.7

Overview

The skill’s finance features are mostly disclosed and purpose-aligned, but its local install and update instructions execute mutable remote GitHub code that would receive a sensitive Agent Token.

Install with caution. Prefer the official remote MCP endpoint or a pinned, reviewed release/commit instead of the README’s unpinned git+https commands, and do not run pipe-to-shell installer commands from an elevated shell. Treat HUAHUA_AGENT_TOKEN as sensitive because it can read portfolio and transaction data; rotate or revoke it if you installed from an untrusted or mutable source.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:60
• Finding: Remote Installer Content Is Executed Directly by the User's Shell<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 60-63 **Vulnerability Type**: Remote script retrieval followed by immediate shell execution **Risk Level**: Critical ### Vulnerable Code ```bash # macOS / Linux curl -LsSf https://astral.sh/uv/install.sh | sh # Windows powershell -c "irm https://astral.sh/uv/install.ps1 | iex" ``` ### Technical Analysis The installation instructions retrieve mutable content from an external URL and immediately execute it using `sh` or PowerShell's `Invoke-Expression`. There is no intervening inspection, cryptographic checksum verification, signature verification, or immutable version selection. Consequently, the effective code executed by these commands can change after this project has been reviewed. HTTPS protects the connection in transit under normal conditions, but it does not protect against compromise of the hosting account, domain, deployment pipeline, upstream installer, or trusted certificate infrastructure. This behavior is not required for the Skill's fund-management functionality. It is only an installation convenience and exceeds the minimum safe privilege boundary by permitting externally controlled content to execute with the invoking user's permissions. ### Attack Path 1. An attacker compromises the remote installer, its hosting infrastructure, DNS resolution, deployment credentials, or another trusted component in the delivery chain. 2. The attacker modifies `install.sh` or `install.ps1` to contain malicious commands. 3. A user follows the documented installation command. 4. `curl` or `Invoke-RestMethod` retrieves the modified payload. 5. The shell executes the response immediately, without giving the user an opportunity to inspect or verify it. 6. The payload operates with the privileges of the user running the installation command. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. Depending on that account's ...[truncated 504 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all pipe-to-shell and download-to-`Invoke-Expression` installation instructions. 2. Prefer a trusted operating-system package manager with a pinned package version. 3. If a standalone installer is necessary: - Link to an immutable, versioned release artifact. - Publish a SHA-256 or stronger digest through an independent trusted channel. - Provide signature-verification instructions. - Require users to download the artifact first, verify it, and only then execute it. 4. Document the exact expected installer version and provenance. 5. Recommend installation from a non-elevated account unless elevated privileges are explicitly necessary. 6. Keep a safer alternative, such as a pinned Python package or reviewed source archive, as the primary installation method. ]]>

T08 · Insecure Dependencies

Error

• Location: README.md:70
• Finding: Mutable Git Branch Is Used as an Executable Package Source<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 70-92 **Vulnerability Type**: Unpinned source dependency and mutable installation target **Risk Level**: High ### Vulnerable Code ```json { "mcpServers": { "huahua-daily": { "command": "uvx", "args": [ "--from", "git+https://github.com/baiye1997/HuaHuaDailyMCP", "huahua-daily" ], "env": { "HUAHUA_API_BASE": "https://api.huahuadaily.cn", "HUAHUA_AGENT_TOKEN": "粘贴你的 Agent Token" } } } } ``` ```bash pip install git+https://github.com/baiye1997/HuaHuaDailyMCP ``` ### Technical Analysis Both installation methods resolve the repository's mutable default branch because neither command specifies an immutable commit hash or a verified release tag. The installed package can therefore differ from the artifact that was audited. The `uvx` configuration is especially sensitive because it launches the package as an MCP server and supplies `HUAHUA_AGENT_TOKEN` in its environment. If the repository is compromised or receives malicious changes, subsequently resolved package code can execute locally and access that token. The runtime dependencies in `pyproject.toml` and `requirements.txt` also use version ranges rather than a hash-locked dependency set. No evidence of dependency confusion or a currently malicious third-party package was found, but the mutable Git source creates a direct supply-chain execution path. ### Attack Path 1. An attacker compromises the GitHub repository, a maintainer account, or the default branch. 2. The attacker commits malicious package initialization or entry-point code. 3. A new user runs the unpinned `pip install` command, or an MCP client resolves the unpinned `uvx --from` source. 4. The package manager downloads and installs the attacker's current branch contents. 5. The `huahua-daily` entry point executes the altered code. 6. In the documented MCP configuration, the malicious process ...[truncated 949 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace mutable Git URLs with an immutable reviewed commit, for example: ```text git+https://github.com/baiye1997/HuaHuaDailyMCP@<full-reviewed-commit-hash> ``` 2. Prefer signed, versioned releases distributed through a package registry with published artifact hashes. 3. Pin all direct and transitive dependencies in a lock file suitable for deployment. 4. Use hash verification, such as pip's `--require-hashes`, where practical. 5. Establish release provenance through signed tags, protected branches, mandatory review, and restricted maintainer credentials. 6. Ensure updates are explicit and display the exact target version or commit before installation. 7. Avoid placing long-lived tokens directly in static MCP configuration when the client supports a protected secret store. ]]>

T08 · Insecure Dependencies

Error

• Location: huahua_mcp_runtime/version.py:13
• Finding: Update Instructions Reinstall Code from an Unpinned Repository Branch<![CDATA[ ## Vulnerability Details **File Location**: `huahua_mcp_runtime/version.py`, lines 13-18 **Vulnerability Type**: Unsafe supply-chain update source **Risk Level**: High ### Vulnerable Code ```python "pip": ( "运行 python -m pip install --upgrade --force-reinstall " "git+https://github.com/baiye1997/HuaHuaDailyMCP，然后重启 MCP。" ), "restartRequired": True, ``` ### Technical Analysis The update mechanism is advisory rather than automatic: `update_check.py` only retrieves a bounded version declaration and does not execute downloaded content. However, the update instructions returned to users direct them to force-reinstall package code from an unpinned Git repository. Because no tag or commit hash is specified, the command installs whatever content is present on the default branch at execution time. `--force-reinstall` additionally replaces the installed version even when the existing installation may be known and reviewed. The update-status source URL can be overridden through `HUAHUA_MCP_VERSION_SOURCE_URL`, but the parser accepts only a semantic-version assignment and does not execute the fetched response. The confirmed execution risk arises when the user follows the mutable Git reinstall instruction. ### Attack Path 1. An attacker compromises the repository's default branch or a maintainer account. 2. The attacker publishes a higher-looking semantic version in the repository and introduces malicious package code. 3. The runtime update check reports that an update is available. 4. The user obtains the update instructions and runs the documented force-reinstall command. 5. pip downloads the current mutable branch and installs it without binding the operation to the reviewed version value. 6. After restart, the modified MCP package executes with access to the process environment, Agent Token, network, and user-accessible files. ### Impact Assessment The resulting package executes with the MCP server user's privileges. Potential impact include ...[truncated 468 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bind update instructions to the exact version reported by the update service. 2. Install from a signed immutable release tag, exact commit hash, or versioned package-registry artifact. 3. Verify the downloaded artifact against a published cryptographic digest or signature. 4. Avoid `--force-reinstall` unless corruption recovery specifically requires it. 5. Return release provenance with update metadata, including the expected commit, artifact hash, and signature identity. 6. Keep updates user-initiated, as the current implementation does, and do not automatically execute package-manager commands. 7. Validate that the version metadata and selected installation artifact refer to the same immutable release. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (54)

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# macOS / Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows
powershell -c "irm https://astral.sh/uv/install.ps1 | iex"

• Confidence: 99% confidence
• Finding: `curl ... | sh` is a high-risk command chaining pattern that immediately executes network-retrieved content in a shell. In this skill's context, successful exploitation could compromise the host running the MCP or CLI, steal `HUAHUA_AGENT_TOKEN`, and expose sensitive financial records or manipulate future MCP interactions.

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

• Category: YARA Match

Content

y": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/baiye1997/HuaHuaDailyMCP",
        "huahua-daily"
      ],
      "env": {
        "HUAHUA_API_BASE": "https://api.huahuadaily.cn",
        "HUAHUA_AGENT_TOKEN": "粘贴你的 Agent Token"
      }
    }
  }
}
```

### 方式三：pip 安装

如果不想安装 uv，可以用 pip 全局安装：

```bash
pip install git+https://github.com/baiye1997/HuaHuaDailyMCP
```

**MCP 配置**：

```json
{
  "mcpServers": {
    "huahua-daily": {
      "command": "huahua-daily",
      "env": {
        "HUAHUA_AGENT_TOKEN": "粘贴你的 Agent Token"
      }
    }
  }
}
```

### 方式四：本地运行

```bash
# 克隆仓库
git clone https://github.com/baiye1997/HuaHuaDailyMCP.git
cd HuaHuaDailyMCP

# 安装依赖
pip install -r requirements.txt

# 运行
HUAHUA_AGENT_TOKEN=你的Token python server.py
```

HuahuaDaily 主仓库联调使用工作区 MCP，避免调用已安装的生产版本。启动�

• Confidence: 96% confidence
• Finding: The README promotes installing directly from `git+https://github.com/...` and also cloning/running from the repository. This is a remote bootstrap execution path without immutable pinning, so a compromised repo or malicious update could deliver arbitrary code that runs with the user's privileges and gains access to stored tokens and sensitive investment data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Undisclosed outbound network access for update checks expands the trust boundary beyond the finance service and can leak environment metadata, create unexpected external dependencies, or enable supply-chain style risks if version sources are compromised. Because the stated purpose is portfolio/trade assistance, contacting unrelated update endpoints is more dangerous than ordinary documented API use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Undisclosed outbound network access for update checks expands the trust boundary beyond the finance service and can leak environment metadata, create unexpected external dependencies, or enable supply-chain style risks if version sources are compromised. Because the stated purpose is portfolio/trade assistance, contacting unrelated update endpoints is more dangerous than ordinary documented API use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Undisclosed outbound network access for update checks expands the trust boundary beyond the finance service and can leak environment metadata, create unexpected external dependencies, or enable supply-chain style risks if version sources are compromised. Because the stated purpose is portfolio/trade assistance, contacting unrelated update endpoints is more dangerous than ordinary documented API use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: Undisclosed outbound network access for update checks expands the trust boundary beyond the finance service and can leak environment metadata, create unexpected external dependencies, or enable supply-chain style risks if version sources are compromised. Because the stated purpose is portfolio/trade assistance, contacting unrelated update endpoints is more dangerous than ordinary documented API use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Undisclosed outbound network access for update checks expands the trust boundary beyond the finance service and can leak environment metadata, create unexpected external dependencies, or enable supply-chain style risks if version sources are compromised. Because the stated purpose is portfolio/trade assistance, contacting unrelated update endpoints is more dangerous than ordinary documented API use.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The top-level skill description is presented entirely in Chinese and does not indicate that other languages are supported or that the user may choose a preferred language. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The README instructs users to run the MCP server directly from a Git repository via `uvx --from git+https://...` without pinning a specific commit, tag, or immutable release artifact. That creates a supply-chain risk: if the upstream repo is changed or compromised, users may execute different code than expected and expose their `HUAHUA_AGENT_TOKEN`, which grants access to sensitive portfolio and transaction data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: This is the same unpinned remote Git execution pattern in another configuration example. Because the skill handles highly sensitive financial data and tokens, any future change to the referenced repository could turn routine setup into arbitrary code execution with access to credentials and user investment data.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill routes the agent to use environment tokens, local file paths via CLI, and remote HTTP endpoints, but it does not declare an explicit tool scope such as allowed tools or permissions. That mismatch weakens least-privilege controls and can let an agent or host grant broader file, network, or environment access than users expect from the manifest alone.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This code fetches the full synced portfolio state and writes it to disk, which can affect user privacy if the file is stored in an insecure location. Although the command name suggests export behavior, there is no inline confirmation, warning comment, or user-facing disclosure that the output may contain sensitive financial data.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file returns user-facing error strings exclusively in Chinese, such as token configuration and transport/authentication messages, without offering a language option or documenting a Chinese-only locale constraint. This can violate language/locale policy when the skill does not explicitly obtain user opt-in or justify the restriction.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The raised error message is hard-coded in Chinese, which imposes a specific language on users regardless of their locale or preferences. The file does not offer any language choice or indicate that the skill is intentionally region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This exception message is hard-coded in Chinese, creating a locale-specific user experience without opt-in or fallback. That conflicts with the requirement to avoid forcing a language unless the constraint is documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The runtime error text is presented only in Chinese and there is no indication of user locale selection or regional scoping. This is a natural-language policy issue because it forces a specific language on all users.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This hard-coded Chinese error message is user-facing and does not provide language choice or fallback behavior. Without documented regional justification, it constitutes a locale policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The function docstring is written entirely in Chinese and provides the operative description of the skill behavior without indicating any user language choice or locale-specific justification. This can violate language/locale policy when a skill implicitly assumes a specific language rather than offering opt-in or documenting a required regional scope.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The raised RuntimeError contains a Chinese-only message, which imposes a specific language in user-visible output. This file does not offer localization, user opt-in, or documentation showing that the skill is intentionally limited to a Chinese-language context.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This code returns a user-facing ValueError message entirely in Chinese, which imposes a specific language choice in natural-language output. The file does not indicate that the skill is China-specific or that users can opt into this locale, so it fits the language/locale policy violation category.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: Multiple ValueError strings in this validation module are hard-coded in Chinese, including messages for date format, field validation, and metadata constraints. Because these natural-language outputs enforce one language across the module without opt-in or clear regional scoping, they violate the stated language/locale policy.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code file contains natural-language docstrings that define tool behavior entirely in Chinese, and the pattern continues throughout the file. That effectively forces a specific language/locale for users or integrators without any visible opt-in, which matches the language-policy violation criteria.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This code file exposes complete cloud sync portfolio data, and when include_json_text is true it returns the server's raw JSON payload. Although the docstring describes the behavior, there is no runtime confirmation, logging, or explicit caution that the response may include sensitive financial records and should only be used for audit/export scenarios.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The function returns transaction流水 for all funds or a selected fund, which is sensitive personal financial data. The docstring explains functionality but does not clearly warn users about the privacy impact, and there is no runtime notice or confirmation before disclosure.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This file contains multiple user-facing error messages in Chinese, such as at L040, L047-L049, L055-L061, and L067-L073, with no indication that the skill is intentionally region-specific or that users can choose a language. That creates a natural-language locale policy concern because the tool effectively forces one language for validation feedback.

Static analysis

No suspicious patterns detected.