T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_stock_excel.py:33- Finding
Spreadsheet Formula Injection in Generated Excel Workbooks
- Content
View full analysis
- Remediation
View remediation
Security audit
"i问财选股技能"
Security checks for vulnerabilities and agentic risk
Overview
This stock-screening skill appears purpose-aligned, but it needs review because it can auto-activate broadly, fetch/read user-supplied content, and write Excel files with weak output and spreadsheet-safety controls.
Install only if you are comfortable with the agent using web access and local files for stock screening. Ask it to confirm before reading files or writing Excel output, use a controlled export directory, and treat generated spreadsheets and stock picks as unverified analysis rather than investment advice.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/generate_stock_excel.py:33- Finding
Unrestricted Output Path Allows Overwriting Writable Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims it will analyze user-provided links/files/text, identify relevant sectors, query i问财, and return screened stock results, but the finding indicates the implementation does not actually perform those actions and mainly exports data. This kind of description-behavior mismatch is dangerous because users and downstream agents may rely on outputs as if they were based on real market analysis and external queries, creating integrity and decision-risk from fabricated or incomplete results.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger condition '模型自行根据语义判断需要选股的场景' allows open-ended self-activation without a precise boundary, which can cause the skill to run on loosely related prompts or sensitive financial discussion that did not explicitly request stock screening. In a finance-oriented skill, overbroad invocation increases the chance of unintended external access, misleading investment-style output, or unwanted file generation based on misunderstood user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The auto-activation triggers are broad and loosely scoped, including generic phrases like 'XX选股', '分析利好哪些行业', and any link/text followed by a request to analyze and pick stocks. In an agent environment, this can cause the skill to activate on ambiguous user input or unrelated content, leading to unintended web access, content processing, and stock-screening actions without sufficiently clear user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Several triggers such as 'XX选股', '根据XX选股', and '分析利好哪些行业' are broad enough to match many contexts without reliably distinguishing whether the user wants financial screening, general explanation, or something else. This can cause accidental invocation and output of authoritative-seeming stock recommendations in situations where the user did not clearly consent to that workflow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill specifies generating and saving an Excel file to a local filesystem path without stating that the user will be warned or asked for consent first. Unannounced file writes can surprise users, create privacy or storage issues, and in multi-skill environments may leave behind sensitive financial data artifacts on disk.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script has an undocumented demo mode that activates when no arguments are provided and writes a file to a hard-coded absolute path under a local workspace directory. In an agent/tooling context, unexpected file writes can violate least surprise, leak artifacts into sensitive locations, or fail unpredictably depending on the runtime environment; while not directly code execution, it is unsafe behavior for automation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring is entirely in Chinese and the usage/help text does not indicate any language choice, which can impose a specific language on users. In addition, the built-in demo output filename later uses Chinese characters, reinforcing a fixed locale without opt-in or a stated region-specific purpose.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The default demo filename includes the Chinese phrase "选股结果", which enforces a specific language/locale in generated artifacts. The file does not offer an alternative naming locale or explain that the skill is intentionally limited to a Chinese-language context.
- Content
Static analysis
No suspicious patterns detected.