Security audit

yanlin-macro-data

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it presents financial data collection while mixing hardcoded snapshot values with live-looking output and contradictory northbound-flow documentation.

Install only for classroom or demo use unless the publisher fixes the data provenance issues. Do not rely on its figures for investment, trading, or automated reporting without independently verifying them, and expect outbound requests to Sina Finance when network access is available.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill’s declared purpose and documented behavior are inconsistent: it claims macro/liquidity collection, omits promised northbound-flow support, includes undeclared U.S. stock quote collection, and relies heavily on static snapshots instead of real-time data. This mismatch is dangerous because users, reviewers, or downstream agents may make trust or execution decisions based on inaccurate capability descriptions, enabling deceptive data provenance and unintended external access.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documents network-backed data collection but does not declare any explicit tool scope such as allowed network access. Undeclared capabilities weaken reviewability and policy enforcement because an agent may invoke network operations without clear user- or platform-visible constraints.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The output example contains northbound capital flow data even though the documentation says the skill does not provide it. Contradictory examples can mislead integrators into believing unsupported data exists, causing incorrect automation, false analytical conclusions, or trust in fabricated fields.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description claims it collects 北向资金 data, but the implementation neither fetches nor outputs any such metric. In a financial-analysis context, this is dangerous because downstream users or agents may rely on incomplete data while believing the dataset is comprehensive, leading to incorrect analysis or decisions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and all user-facing output are written exclusively in Chinese, and the script provides no option for the user to select another language. This is a natural-language locale constraint embedded in the skill behavior and is not documented as a region-specific or opt-in limitation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Several macro and FX values are hardcoded while the skill presents itself as a data collection script, creating a data integrity issue. In a market or investment workflow, stale or fabricated-looking values can mislead users into treating placeholder numbers as live inputs, which can propagate bad decisions or erroneous reports.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The natural-language content describing the skill, warnings, and usage is presented only in Chinese. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation unless the restriction is explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The inline comment acknowledges the values are not live, yet the script emits them in a production-like report without any disclaimer. This mismatch increases the risk of deceptive output because consumers may not inspect the source code and will reasonably assume the printed figures were collected dynamically.
Content: No source excerpt is available for this finding.