Security audit

Etf

Security checks for vulnerabilities and agentic risk

Overview

This skill is advertised as an ETF analysis tool, but its artifacts implement a generic local input logger with persistent plaintext history instead of ETF analysis.

Review carefully before installing. This does not appear to exfiltrate data or install a backdoor, but it is not a real ETF analysis skill as advertised and may persist anything you type into it under ~/.local/share/etf. Avoid entering sensitive portfolio, account, or research data unless the publisher narrows the scope, implements actual ETF analysis, and adds clear retention and deletion controls.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:164
Finding: Misleading ETF Functionality and Plaintext Retention of User Input
Content: View full analysis
/dev/null || echo " No entries yet. Use: etf analyze " else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/analyze.log" local total=$(wc -l < "$DATA_DIR/analyze.log") echo " [Etf] analyze: $input" echo " Saved. Total analyze entries: $total" _log "analyze" "$input" fi ;; ``` Equivalent storage behavior appears in the handlers for `run`, `check`, `convert`, `generate`, `preview`, `batch`, `compare`, `export`, `config`, `status`, and `report`. No ETF parsing, holdings analysis, metric comparison, or sector-allocation processing is implemented. If these handlers execute in a context where their `local` declarations are valid, arbitrary arguments—including portfolio details or other sensitive information—are retained in plaintext under `~/.local/share/etf/`. In ordinary direct script execution, the top-level `local` declarations produce a Bash error and, because `set -e` is enabled, generally prevent the writes from completing. This defect limits exploitation in the current direct-execution path, but it does not make the intended ...[truncated 1636 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:52
Finding: Unsafe JSON and CSV Export Construction
Content: View full analysis
"$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "\n]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" done ;; txt) echo "=== Etf Export ===" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue echo "--- $(basename "$f" .log) ---" >> "$out" cat "$f" >> "$out" done ;; *) echo "Formats: json, csv, txt"; return 1 ;; esac echo "Exported to $out ($(wc -c < "$out") bytes)" } ``` For JSON, quotation marks, backslashes, control characters, and line breaks in `name`, `ts`, or `val` are not escaped. An attacker-controlled value can therefore corrupt the document or alter its apparent structure. For CSV, fields containing commas, quotation marks, or newlines are not quoted according to CSV rules. Values beginning with spreadshee ...[truncated 2165 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/script.sh:121
Finding: Broken Command Dispatch and Invalid Top-Level Local Declarations
Content: View full analysis
/dev/null || echo " No entries yet. Use: etf run " else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/run.log" local total=$(wc -l < "$DATA_DIR/run.log") echo " [Etf] run: $input" echo " Saved. Total run entries: $total" _log "run" "$input" fi ;; ``` In normal script execution, Bash only permits `local` inside functions. The first declaration therefore fails. Because the script enables `set -e`, execution generally terminates before the intended operation completes. The dispatcher also defines duplicate `export` and `status` patterns. The earlier patterns always capture those commands: ```bash export) shift if [ $# -eq 0 ]; then echo "Recent export entries:" tail -20 "$DATA_DIR/export.log" 2>/dev/null || echo " No entries yet. Use: etf export " else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/export.log" local total=$(wc -l < "$DATA_DIR/export.log") echo " [Etf] export: $input" echo " Saved. Total export entries: $total" _log "export" "$input" fi ;; ``` Later definitions intended to call the actual implementations are unreachable: ```bash stats) _stats ;; export) shift; _export "$@" ;; search) shift; _search "$@" ;; recent) _recent ;; status) _status ;; ``` As a result, `etf export ` does not in ...[truncated 1687 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as an ETF-analysis tool, but the documented behavior is a generic local logging and data-recording utility that stores arbitrary inputs and activity history under the user's home directory. This mismatch is dangerous because users may provide sensitive financial queries or data under false expectations, while the skill persists and exposes that information through search/export/report features unrelated to the declared purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest claims ETF holdings and fund-metric analysis, but the body describes an offline terminal tool for recording, searching, exporting, and logging arbitrary data. This discrepancy undermines informed consent and can mislead users into invoking a broad local data utility when they expected a narrow financial-analysis skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The implemented behavior does not match the declared ETF-analysis purpose: instead of analyzing holdings, metrics, or allocations, the script exposes a generic local toolkit and logger. Capability mismatch is dangerous because users or orchestrators may grant trust, install, or invoke the skill expecting limited financial-analysis behavior while it actually performs unrelated data collection and file generation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The file states the tool works entirely offline and that data never leaves the machine, while the manifest frames the skill as analyzing ETF holdings, fund metrics, and sector allocations. Those analytics normally depend on obtaining current ETF data, so the documentation describes a materially different operating model than the manifest's stated intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation advertises automatic history and activity logging without a prominent warning, consent flow, or retention details. Persistent logging of user inputs can capture sensitive financial research, identifiers, filenames, or operational context, especially dangerous when users believe they are using a simple analysis skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documented command set is broad and generic, including run/check/convert/generate/batch/config/export/search/report operations that are not tied to ETF analytics. Such overbroad functionality increases the risk of misuse, hidden data collection, and user confusion about what the skill actually does.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script creates persistent storage under the user's home directory and writes history/export artifacts, which exceeds a read-oriented analysis skill's expected behavior. Undisclosed persistence can capture sensitive queries or financial research activity over time, creating privacy and data-governance risk if the host assumes ephemeral processing.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The presence of broad, unrelated commands such as config, batch, generate, and preview expands the skill's capability surface beyond its stated ETF-analysis role. Even without overt code execution, unnecessary capabilities increase abuse potential, reduce auditability, and make it harder for users to understand what the skill is actually doing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: User-supplied inputs are appended verbatim to local log files without notice, redaction, or retention controls. In the ETF-analysis context, users may enter portfolio details, tickers under evaluation, or other sensitive research notes, so silent persistence meaningfully increases privacy exposure and accidental disclosure risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.