T09 · Insecure Skill Coding Practices
Error
- Location
scripts/dividends.py:115- Finding
API Credential Can Be Redirected to an Arbitrary Network Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
stock-dividend-zh
Security checks for vulnerabilities and agentic risk
Overview
This dividend-analysis skill is mostly coherent, but an undocumented endpoint override can redirect the user's AISA API key and requests to another server.
Review before installing. Use it only in an environment where AISA_BASE_URL cannot be set by untrusted shell startup files, wrappers, CI variables, or other users, and consider pinning the openai dependency. Expect ticker prompts and the AISA_API_KEY-backed request to leave the machine for the AISA service.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
scripts/dividends.py:2- Finding
Security-Sensitive Runtime Dependency Is Not Reproducibly Pinned
- Content
View full analysis
=3.10" # dependencies = [ # "openai>=1.0.0", # ] # /// ``` ### Technical Analysis The inline dependency declaration permits any current or future `openai` package release satisfying `>=1.0.0`. The project contains no reviewed exact version, lockfile, or package hash that would make installation reproducible and integrity-verifiable. This dependency is security-sensitive because it runs in the same Python process that reads `AISA_API_KEY` and performs authenticated network requests. Imported package code receives the privileges of the user executing the Skill and can access process environment variables, local files available to that user, and network resources. The package name is not an apparent typosquat, and the audit found no evidence that the currently intended package is malicious. The risk arises from resolving unreviewed future versions or a compromised distribution when users execute the script through a dependency-aware runner such as the documented `uv run` examples in the script header. ### Attack Path 1. A user executes the script using a tool that processes the inline dependency metadata, such as `uv run`. 2. The resolver selects a future or otherwise unreviewed `openai` release because any version at or above `1.0.0` is allowed. 3. The selected artifact is compromised at the package source, maintainer account, registry, distribution infrastructure, or another supply-chain stage. 4. Malicious package code executes during import, initialization, or API use inside the Skill process. 5. The package accesses `AISA_API_KEY`, alters request destinations or contents, reads data available to the invoking user, or performs unauthorized network operations. ### Impact Assessment A malicious resol ...[truncated 491 chars]- Remediation
View remediation
", # ] ``` 2. Generate and commit a lockfile where the selected execution workflow supports one. 3. Require cryptographic hashes for downloaded artifacts when supported by the package manager. 4. Use only trusted package indexes and disable unintended fallback indexes to reduce dependency-confusion exposure. 5. Establish a controlled update process that reviews release notes, dependency changes, provenance, and security advisories before changing the pinned version. 6. Align `SKILL.md` with the actual execution method and explicitly document whether users should run the script with `python3`, `uv`, or another dependency manager. 7. Run the Skill in a restricted environment with only the required API credential, minimal filesystem access, and constrained outbound network access. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description and the markdown instructions are presented only in Chinese, which effectively forces a specific language for users of the skill. The policy requires either a user language choice/opt-in or a clearly documented justification for the locale restriction, neither of which appears here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest sets the skill language to "zh", which indicates a fixed language/locale choice. In this file there is no accompanying opt-in, alternative language option, or justification that the skill is intentionally region-specific.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python print("❌ Error: AISA_API_KEY environment variable is not set.", file=sys.stderr) print(" Set it with: export AISA_API_KEY=your_key_here", file=sys.stderr) sys.exit(1) base_url = os.environ.get("AISA_BASE_URL", "https://api.aisa.one/v1") return OpenAI(api_key=api_key, base_url=base_url)