my_stock_tradeagents_rebuild_skill

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:27 AM UTC
• Version: 1.0.3

Overview

This skill rebuilds a local TradingAgents environment but also automatically commits and pushes all workspace changes to a remote repository without review.

Install only if you are comfortable with an agent deleting ~/TradingAgents/venv, installing local Python package code, and automatically publishing all unignored workspace changes to the configured Git remote. Review the repository status, remove secrets or unrelated files, verify origin, and require explicit approval before any commit or push.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

other

Error

• Location: SKILL.md:43

Finding

Unrestricted Staging and Remote Upload of Workspace Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43-48
Vulnerability Type: Unintended Data Exposure
Risk Level: High

Technical Analysis

The skill instructs the agent to stage all unignored files under ~/TradingAgents, commit them, create a branch, and push the commit to the repository's configured origin:

bash

git add .
git commit -m "Auto-commit: 重新构建 TradingAgents 环境并更新相关文件"
BRANCH_NAME="feature/rebuild-$(date +%Y%m%d%H%M%S)"
git checkout -b $BRANCH_NAME
git push origin $BRANCH_NAME

The unrestricted git add . command does not distinguish intended source changes from credentials, local configuration files, generated artifacts, proprietary data, or unrelated modifications. The subsequent git push transfers the resulting commit to an unspecified remote without first validating the remote owner, reviewing the staged diff, scanning for secrets, or obtaining confirmation.

These repository operations are not required to recreate a Python virtual environment. The metadata in skill.json also describes only environment reconstruction and does not disclose the automatic commit-and-push behavior, limiting the user's ability to provide informed consent.

Attack Path

1. A sensitive or proprietary file exists as an unignored file under ~/TradingAgents.
2. Alternatively, an attacker introduces such a file or changes the repository's origin URL to a server under the attacker's control.
3. The user requests reconstruction of the TradingAgents environment.
4. The skill executes git add ., staging the sensitive file along with all other unignored changes.
5. The skill creates a commit without presenting the staged content for review.
6. The skill creates a timestamped branch and pushes it to the configured origin.
7. Anyone with access to that remote repository can retrieve the committed data.

Impact Assessment

Successful exploitation can disclose any readable, unigno ...[truncated 405 chars]

Remediation

View remediation

Remediation Suggestions

• Remove automatic staging, committing, and pushing from the environment-rebuild workflow.
• Perform Git publication only when the user separately and explicitly requests it.
• Display and validate the resolved origin URL before any network operation.
• Use an explicit allowlist of expected files instead of git add ..
• Show git status, git diff, and git diff --cached before creating a commit.
• Run a secret scanner against staged files and abort when credentials or sensitive data are detected.
• Require explicit user confirmation immediately before both the commit and push operations.
• Document all repository mutation and network behavior accurately in skill.json.
• Where possible, use a remote account or token restricted to the minimum necessary repository and branch permissions.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:36

Finding

Execution of Unreviewed Local Build Hooks and Unpinned Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36-39
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Technical Analysis

The skill upgrades pip and installs the package located in the current workspace:

bash

./venv/bin/pip install --upgrade pip
./venv/bin/pip install .

A local package installation can execute build-system code and hooks declared by project-controlled packaging files. It can also download transitive dependencies from configured package indexes. The documented process does not require pinned versions, cryptographic hashes, a reviewed lock file, trusted-index validation, or inspection of the local build configuration.

Although installation targets a virtual environment, package build and installation processes run with the invoking user's operating-system privileges. Virtual environments isolate Python packages; they are not security sandboxes and do not prevent malicious installation code from reading user files, modifying the workspace, accessing the network, or launching subprocesses.

Attack Path

1. An attacker modifies packaging metadata or build hooks in the ~/TradingAgents project, or causes dependency resolution to select a malicious package through a compromised package, dependency confusion, or an unsafe package index.
2. The user invokes the rebuild skill.
3. The skill executes pip install ..
4. Pip processes attacker-controlled package metadata, resolves dependencies, and may execute malicious build or installation code.
5. The payload runs with the privileges and accessible credentials of the user who invoked the skill.
6. The payload can access local files, environment variables, Git credentials, and network resources available to that user.

Impact Assessment

Exploitation can result in arbitrary code execution as the invoking user. The resulting scope can include reading or altering files accessible to that account, stealing en ...[truncated 257 chars]

Remediation

View remediation

Remediation Suggestions

• Require a reviewed dependency lock file with exact versions and cryptographic hashes.
• Install with hash enforcement, such as pip install --require-hashes, using an appropriate locked requirements file.
• Restrict installation to explicitly approved package indexes and disable unintended extra indexes.
• Review pyproject.toml, setup.py, setup.cfg, and build-system requirements before installation.
• Avoid automatically upgrading pip to an uncontrolled latest version; pin and verify the installer version.
• Prefer prebuilt, verified wheels where feasible and reject unexpected source builds.
• Run dependency vulnerability and provenance checks before installation.
• Execute installation in a constrained container or sandbox with limited filesystem, credential, and network access when processing an untrusted workspace.
• Abort if package metadata or the lock file differs from the reviewed state.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:23

Finding

Destructive Recursive Deletion Without Target Validation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-32
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Technical Analysis

The environment-rebuild procedure recursively deletes the existing venv path before recreating it:

bash

# 删除旧环境
rm -rf venv

# 创建新环境 (使用系统 python3.13)
python3.13 -m venv venv

# 激活环境
source venv/bin/activate

The command performs deletion without verifying the canonical current directory, inspecting the target, checking whether the target has an unexpected type or layout, or confirming that it contains only a disposable virtual environment. Although the workflow separately directs execution from ~/TradingAgents, the deletion command itself does not enforce that precondition.

This is an unsafe destructive-operation pattern. If execution occurs in an unexpected directory, or if venv is not the intended disposable environment, files can be irreversibly removed. The fixed relative target reduces exposure compared with deleting a user-supplied path, but validation and confirmation are still absent.

Attack Path

1. The skill runs from a directory other than the expected canonical ~/TradingAgents directory, or the workspace contains an unexpected venv directory holding non-disposable data.
2. The skill executes rm -rf venv without checking the resolved workspace and target.
3. The target's contents are recursively removed.
4. The following python3.13 -m venv venv command creates a new environment at that path, potentially obscuring evidence that unrelated content previously occupied it.

Impact Assessment

The impact is deletion of files reachable under the selected venv directory and owned or writable by the invoking user. This can cause local data loss and development-environment disruption. The documented command does not establish privilege escalation, deletion outside the relative target, or system-wide compromise ...[truncated 1 chars]

Remediation

View remediation

Remediation Suggestions

• Resolve the workspace to a canonical absolute path and verify that it exactly matches the approved project directory before deletion.
• Resolve the deletion target and ensure it is the expected ~/TradingAgents/venv path.
• Refuse to proceed if the workspace or target has an unexpected type, owner, or layout.
• Inspect the target for a valid virtual-environment marker, such as pyvenv.cfg, before treating it as disposable.
• Present the exact canonical deletion path and require confirmation before recursively deleting it.
• Use a narrowly scoped implementation that cannot accept user-controlled deletion paths.
• Create the replacement environment only after successful validation, and report deletion failures instead of suppressing them.
• Recommend backups or recreation from a clean checkout when the target contains unexpected files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill directs the agent to stage all files, create a commit, create a branch, and push to a remote repository automatically, without requiring the user to review the diff or approve the outbound action. This is dangerous because it can exfiltrate sensitive files, publish unintended modifications, or create irreversible repository history changes, especially since git add . indiscriminately includes everything in the workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to run rm -rf venv automatically, which is a destructive operation, without any user confirmation, backup step, or warning about data loss. Even though the deletion is scoped to ~/TradingAgents, the skill is designed to execute filesystem-destructive actions as part of normal flow, which is unsafe if the environment path is wrong, the directory is not what the operator expects, or the virtual environment contains valuable local state.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description is written only in Chinese, which can impose a language-specific experience without any indication that users may choose another language or that the skill is intended only for a Chinese-speaking context. This matches the policy category for language or locale constraints that are not documented as opt-in or justified.

Content

No source excerpt is available for this finding.