Stock Daily Report

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:44 AM UTC
• Version: 1.0.8

Overview

The skill mostly does what it says, but it combines privileged installation, scheduled recurring runs, external Feishu delivery, and unsafe browser rendering in ways users should review carefully before installing.

Install only if you are comfortable reviewing the shell scripts first. Prefer manual or virtual-environment dependency installation, avoid running sudo from the skill unless you approve the exact OS packages, and do not enable cron or Feishu push unless the recipient and schedule are exactly what you want. Treat generated reports as external-data-driven and not financial advice.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: install.sh:36

Finding

Unpinned Third-Party Packages and Automatically Downloaded Chromium Binary

Content

View full analysis

/dev/null || echo "Chromium download failed; it will be downloaded during the first image generation" ``` ### Technical Analysis The installation script downloads `matplotlib` and `pyppeteer` without pinning versions or verifying package hashes. The exact package code installed therefore depends on the package-index state at installation time rather than on a reproducible, audited dependency set. The script also invokes pyppeteer's downloader to obtain a Chromium executable. The project does not independently pin the expected browser artifact or verify it against a project-maintained cryptographic checksum. Python package installation may execute package build or installation logic. Consequently, compromise of a package release, transitive dependency, configured Python package index, or browser distribution channel could cause attacker-controlled code to execute on the host. The use of `--user` limits the Python installation to the invoking user's environment, but it does not prevent code execution with that user's privileges. ### Attack Path 1. An attacker compromises an upstream dependency release, transitive dependency, package-index response, or browser artifact distribution channel. 2. The user follows the documented installation process and runs `bash install.sh`. 3. `pip3` resolves the unpinned pack ...[truncated 1068 chars]

Remediation

View remediation

pyppeteer== ``` 2. Generate a lock file that includes all transitive dependencies. 3. Require hashes during installation, for example: ```bash python3 -m pip install --require-hashes -r requirements.lock ``` 4. Install dependencies inside a dedicated virtual environment instead of the user's global package environment. 5. Pin the expected Chromium revision and verify the downloaded artifact against a trusted SHA-256 digest before execution. 6. Prefer a browser supplied by a trusted operating-system repository where security updates and package signatures are managed centrally. 7. Separate optional system-font installation from Python dependency setup so the normal installation path does not request `sudo`. 8. Document the expected package index and reject unexpected mirrors or externally configured indexes where feasible. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: generate_report.py:541

Finding

Unsandboxed Chromium Renders HTML Containing Unescaped, Remotely Influenced Values

Content

View full analysis

{stock['name']}{stock['code']}

¥{stock['current']:.2f}

{up_down_arrow} {change_sign}{stock['change']:.2f} ({change_sign}{stock['change_pct']:.2f}%)

{kline_img_html} ''' ``` The resulting HTML ...[truncated 3649 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (54)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented behavior includes scheduled execution and outbound Feishu delivery, but the stated purpose focuses only on report generation. Hidden automation and delivery capabilities increase the risk of unauthorized persistence-like behavior and unreviewed dissemination of generated files to external accounts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior includes scheduled execution and outbound Feishu delivery, but the stated purpose focuses only on report generation. Hidden automation and delivery capabilities increase the risk of unauthorized persistence-like behavior and unreviewed dissemination of generated files to external accounts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The documented behavior includes scheduled execution and outbound Feishu delivery, but the stated purpose focuses only on report generation. Hidden automation and delivery capabilities increase the risk of unauthorized persistence-like behavior and unreviewed dissemination of generated files to external accounts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented behavior includes scheduled execution and outbound Feishu delivery, but the stated purpose focuses only on report generation. Hidden automation and delivery capabilities increase the risk of unauthorized persistence-like behavior and unreviewed dissemination of generated files to external accounts.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · install.sh (reported line 21)May include surrounding context.

sh

if ! command -v pip3 &> /dev/null; then
    echo "⚠️ pip3 未安装，尝试安装..."
    if command -v apt &> /dev/null; then
        sudo apt update && sudo apt install -y python3-pip
    elif command -v yum &> /dev/null; then
        sudo yum install -y python3-pip
    elif command -v brew &> /dev/null; then

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The --noconfirm flag suppresses package-manager confirmation during a privileged install, which is a classic dangerous parameter in installer contexts. It reduces transparency and allows system modifications to proceed without user review, increasing operational and security risk if repositories or package selections are wrong.

Content

Scanner excerpt · install.sh (reported line 72)May include surrounding context.

sh

FONT_INSTALLED=true
    elif command -v pacman &> /dev/null; then
        echo "📦 检测到 Arch 系统，安装 noto-fonts-cjk..."
        sudo pacman -S --noconfirm noto-fonts-cjk
        FONT_INSTALLED=true
    elif command -v brew &> /dev/null; then
        echo "📦 检测到 macOS 系统，macOS 自带中文字体"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documentation indicates capabilities spanning file read/write, shell execution, and network access, but it does not declare an explicit tool scope or permissions boundary. This creates a transparency and least-privilege problem: users may invoke or install a skill whose operational reach is broader than what is formally disclosed, increasing the chance of unintended file, shell, or network actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The natural-language content of the skill description is entirely in Chinese, including installation, usage, warnings, and FAQ sections, with no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without user opt-in is a language/locale policy violation unless the constraint is explicitly justified as region-specific, which is not clearly documented here.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

The documentation instructs users to run sudo package installation commands to modify the host system. Root-level installation increases the blast radius of mistakes, malicious package substitutions, or unsafe install scripts, especially when presented as part of routine setup for a non-essential reporting skill.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

# 安装中文字体（Linux）
# Debian/Ubuntu:
sudo apt install fonts-noto-cjk
# CentOS/RHEL:
sudo yum install google-noto-sans-cjk-fonts
# Arch:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

This line recommends a root-privileged package installation path. Even if intended only for fonts, normalizing sudo use in skill setup can lead users to execute elevated commands without adequate review, increasing host compromise and configuration risk.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

Debian/Ubuntu:

sudo apt install fonts-noto-cjk

CentOS/RHEL:

sudo yum install google-noto-sans-cjk-fonts

Arch:

sudo pacman -S noto-fonts-cjk

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

The skill documentation includes another sudo-based system modification command. Repeated privileged setup instructions broaden the expected trust boundary of the skill and make it more likely users will grant excessive privilege for convenience.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

CentOS/RHEL:

sudo yum install google-noto-sans-cjk-fonts

Arch:

sudo pacman -S noto-fonts-cjk

text

## 使用方法

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill instructs users to add a crontab entry for recurring execution. Scheduled persistence is security-relevant because it creates an ongoing execution foothold that can continue making network requests, generating files, or invoking later-modified scripts without renewed user review.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

编辑 crontab：

bash

crontab -e

添加（交易日 9:25 生成，集合竞价后）：

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

This crontab instruction schedules recurring generation and outbound push to Feishu. Persistent automated execution combined with external delivery is more dangerous than local scheduling alone because it can repeatedly transmit generated content to an external service with minimal visibility after initial setup.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

编辑 crontab：

bash

crontab -e

添加（交易日 9:25 生成并推送）：

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The documentation again advises sudo package installation for fonts. While not inherently malicious, privileged commands in a skill setup path increase operational risk and can be abused if users are conditioned to trust and copy-paste root commands from unvetted skills.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md

需要安装中文字体才能正常显示中文：

- **Debian/Ubuntu**: `sudo apt install fonts-noto-cjk`
- **CentOS/RHEL**: `sudo yum install google-noto-sans-cjk-fonts`
- **Fedora**: `sudo dnf install google-noto-sans-cjk-fonts`
- **Arch**: `sudo pacman -S noto-fonts-cjk`

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

This instruction continues the pattern of asking for root-level package installation. In the context of a third-party skill, repeated sudo guidance weakens safe-review practices and raises the potential impact of any hidden or later-modified setup steps.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

md

需要安装中文字体才能正常显示中文：

- **Debian/Ubuntu**: `sudo apt install fonts-noto-cjk`
- **CentOS/RHEL**: `sudo yum install google-noto-sans-cjk-fonts`
- **Fedora**: `sudo dnf install google-noto-sans-cjk-fonts`
- **Arch**: `sudo pacman -S noto-fonts-cjk`
- **macOS**: 系统自带，无需安装

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

Another root-level package installation command appears in the dependency section. The security issue is not the font package itself but the expectation that users should elevate privileges as part of normal skill usage, which increases environmental risk.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md

- **Debian/Ubuntu**: `sudo apt install fonts-noto-cjk`
- **CentOS/RHEL**: `sudo yum install google-noto-sans-cjk-fonts`
- **Fedora**: `sudo dnf install google-noto-sans-cjk-fonts`
- **Arch**: `sudo pacman -S noto-fonts-cjk`
- **macOS**: 系统自带，无需安装

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

This line also prescribes a sudo command for system modification. In aggregate, these instructions make the skill more dangerous in practice because installation extends beyond user-space and can alter the base system for a task that is largely presentational.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

md

- **Debian/Ubuntu**: `sudo apt install fonts-noto-cjk`
- **CentOS/RHEL**: `sudo yum install google-noto-sans-cjk-fonts`
- **Fedora**: `sudo dnf install google-noto-sans-cjk-fonts`
- **Arch**: `sudo pacman -S noto-fonts-cjk`
- **macOS**: 系统自带，无需安装

### 一键安装

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The troubleshooting section repeats sudo installation guidance, reinforcing elevated execution as a standard fix path. This is risky because users under troubleshooting pressure are especially likely to run privileged commands without validation.

Content

Scanner excerpt · SKILL.md (reported line 228)May include surrounding context.

A: 系统缺少中文字体。运行安装脚本或手动安装：

bash

# Debian/Ubuntu
sudo apt install fonts-noto-cjk

# CentOS/RHEL
sudo yum install google-noto-sans-cjk-fonts

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

Another root-level package installation appears in troubleshooting. Even benign admin commands increase the chance of unintended host changes, especially when bundled into a skill that already involves network downloads and shell execution.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

sudo apt install fonts-noto-cjk

CentOS/RHEL

sudo yum install google-noto-sans-cjk-fonts

text

### Q: 图片生成失败？

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The recommended fix includes sudo installation of GUI/browser dependencies, alongside pyppeteer downloading Chromium. This combination increases attack surface and host modification risk, because a document-generation skill now implicitly pulls in a browser runtime and system libraries with elevated install guidance.

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

md

A: 可能原因：
1. 未安装 pyppeteer：`pip3 install pyppeteer --user`
2. 首次运行需要下载 Chromium（可能需要几分钟）
3. 系统缺少依赖库，尝试：`sudo apt install libxss1 libnss3 libatk-bridge2.0-0 libgtk-3-0`

### Q: 为什么没有生成图片？
A: 检查配置：

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The update guide instructs users to run an automated shell script that installs dependencies and modifies the local environment, but it does not clearly warn about the system changes, network downloads, or trust assumptions involved. In a skill ecosystem where users may execute maintainer-provided scripts directly, this increases the risk of unintended package installation or execution of unsafe commands if the script is compromised or overly broad.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The troubleshooting section recommends a system-wide package installation with sudo but does not warn that the command requires elevated privileges and will modify the host system. This is risky because documentation can normalize privileged execution, and in agent/skill contexts users may follow commands without fully evaluating the trust or necessity of those changes.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The documentation explicitly tells users to run a sudo command, which introduces privileged execution into the installation flow. While installing a font package is not inherently malicious, using root-level commands in skill documentation is dangerous because it expands the blast radius of mistakes, social engineering, or future package/script compromise.

Content

Scanner excerpt · UPDATE_GUIDE.md (reported line 133)May include surrounding context.

A: 检查是否安装了 pyppeteer 和中文字体：

bash

pip3 install pyppeteer --user
sudo apt install fonts-noto-cjk  # Debian/Ubuntu

Q: 如何验证版本？

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script performs an outbound Feishu push of the generated report, while the skill is described as a report generator rather than a messaging or exfiltration tool. This expands the skill’s effective capabilities to transmit generated data to an external recipient, which can leak sensitive output or be abused for unauthorized delivery if the target or report contents are manipulated.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The openclaw message send --channel feishu capability enables external communication not justified by the stated purpose of merely generating a daily report. Even if intended for convenience, this creates a data egress path that could send reports or other files to a configured account without sufficient transparency or authorization controls.

Content

No source excerpt is available for this finding.