T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:17- Finding
Real Brokerage Orders May Be Submitted Without Explicit Final User Approval
- Content
View full analysis
- Remediation
View remediation
Security audit
my_stock_decide_execute_skill
Security checks for vulnerabilities and agentic risk
Overview
This skill is transparent about placing real stock trades, but it can proceed to live brokerage orders without a separate final user approval step.
Review this skill carefully before installing. It is intended to place real securities orders through Longbridge, not just provide analysis. Use it only if you are comfortable with an automated trading workflow, and prefer adding a required final confirmation, dry-run default, and order-size limits before any live account is connected.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly orchestrates end-to-end real securities trading and persistent log writing, culminating in actual order placement against a brokerage. Although it has a trigger phrase and sequential checks, it does not present a clear user-facing risk warning, explicit confirmation gate immediately before execution, or stronger safeguards for asset-affecting actions, making unintended or overly trusted execution materially dangerous.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest and instructions are written as mandatory Chinese operational text, including repeated requirements to report outputs to the user ('老大') in that form, but there is no indication that the user can choose another language. This creates a language/locale policy concern because the skill appears to force a specific language without opt-in or stated justification.
- Content