Security audit

同花顺问财ETF选股

Security checks for vulnerabilities and agentic risk

Overview

This ETF skill appears to be a real iWenCai query wrapper, but it needs review because it handles an API key, sends finance queries externally, and leaves some tool and credential behavior under-scoped.

Review before installing. Use IWENCAI_API_KEY from the environment rather than passing --api-key on the command line, avoid sending sensitive investment strategies in queries, and be aware that the skill may send ETF questions to iWenCai and may invoke other financial or search tools unless constrained by the runtime.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/cli.py:69
Finding: API Credential Exposure Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill claims to provide ETF screening logic, but the documented implementation mainly rewrites the user query and forwards it to an external API, with result quality entirely dependent on that service. This mismatch can mislead users and calling agents about what validation, filtering, and parameter handling actually occur, which is dangerous in a finance context where users may overtrust the output.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill performs network access and reads an environment variable API key, but it declares no explicit tool scope or permission boundary. That makes its effective capabilities broader and less auditable, increasing the chance of unintended secret access or unauthorized outbound requests in agent runtimes that rely on manifest-style restrictions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instruction that this skill must be used for any ETF-screening question is overly broad and mandatory, which can force routing even when another safer or more privacy-preserving path would be better. In an agent ecosystem, broad activation rules increase the chance of unnecessary external calls and reduce human or orchestrator control over sensitive financial queries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation describes sending user queries to an external API with API-key-authenticated network requests, but it does not provide a user-facing warning that their query content will be shared off-platform. This is a real privacy and transparency issue, especially for finance-related prompts that may contain sensitive investment interests or strategies.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill authorizes itself to call other financial or search tools when it decides more context is needed, expanding behavior beyond the stated ETF-screening function. That creates tool-chaining and data-propagation risk, because user financial queries may be forwarded to additional services without clear scope limits or consent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The help text says the API address defaults to the value of environment variable IWENCAI_API_URL, implying the tool honors that setting. However, the implementation later assigns api_url = DEFAULT_API_URL unconditionally and never reads IWENCAI_API_URL, so the documentation actively contradicts runtime behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The function docstring describes page, limit, and is_cache as operative parameters to the ETF query. In the request payload, the code uses DEFAULT_PAGE, DEFAULT_LIMIT, and DEFAULT_IS_CACHE instead of the provided arguments, so the documented behavior contradicts what the function actually does.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This Python file performs a POST request to an external API using the user's query content and an Authorization bearer token. While the code is documented as an ETF query tool, there is no visible runtime disclosure, confirmation, or explicit warning in this file that user-provided query text and authentication data will be sent off-host.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Natural-language strings in the module docstring and CLI help force a single locale/language for all users. The policy specifically calls out language or locale restrictions as violations when the skill does not provide a user choice or clearly justify the constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.