T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_stock.py:112- Finding
Unauthenticated HTTP Transport Allows Financial Market Data Manipulation
- Content
View full analysis
- Remediation
View remediation
Security audit
A Stock Trading Assistant Custom
Security checks for vulnerabilities and agentic risk
Overview
The skill is an A-share stock assistant, but it deserves review because it can give actionable trading guidance from unauthenticated market-data requests and persist user price alerts.
Install only if you are comfortable with a skill that queries third-party Chinese financial sites, may store alert/watchlist details, and can produce concrete trading suggestions. Treat outputs as informational, verify prices through trusted sources, and do not rely on its position sizing or buy/sell guidance as personalized investment advice.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger conditions are very broad, covering generic investing and trading-related queries without strong narrowing criteria or explicit user confirmation. This can cause the skill to activate in ordinary financial conversations and steer the interaction toward real-time trading advice, increasing the chance of unintended actions or inappropriate reliance on the skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill hard-locks the interaction to the mainland China A-share market and automatically ignores other markets without obtaining user consent. In practice, this can mis-handle ambiguous stock queries, omit relevant context, and provide advice on the wrong asset universe if the user did not explicitly ask for that restriction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document gives explicit trading actions such as buy/sell signals and follow-on guidance without any risk disclosure, suitability caveat, or statement that the material is informational only. In a skill context, users may treat this as investment advice and act on it directly, increasing the chance of financial loss or inappropriate reliance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file assigns concrete position-sizing ranges by market risk tier, effectively telling users how much capital to deploy. This is more dangerous than generic market commentary because exposure guidance can directly amplify losses for unsuitable users, especially without warnings about volatility, suitability, or the need for professional advice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The title and all instructional content are written entirely in Chinese, which effectively enforces a specific language for using this reference. The policy allows locale constraints only when they are clearly documented and justified or when users are offered a language choice; neither is present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The Accept-Language header is fixed to "zh-CN,zh;q=0.9", which enforces a specific language/locale preference in all requests. This is a natural-language policy concern because the script does not provide an opt-in, override, or justification for forcing that locale.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
Natural-language policy review applies to all file types, and this document presents all instructions and labels exclusively in Chinese. Because there is no opt-in, alternative language option, or justification that the skill is intentionally region-specific, it may violate language/locale choice expectations.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code fetches stock data from Sina Finance and Eastmoney over the network, but the script provides no explicit user-facing notice that it contacts external third-party services. Although networking is core to the script's purpose, there is no disclosure in the CLI help or runtime output before transmitting requested stock symbols and request metadata such as headers.
- Content