yanlin-market-data

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:52 AM UTC
• Version: 1.0.0

Overview

This skill fetches public A-share market data from documented finance sites and does not show hidden persistence, credential use, local data access, or destructive behavior.

Reasonable to install for public market-data lookup. Do not treat its output as authoritative financial advice, especially sector rankings fetched over HTTP; prefer HTTPS or authenticated data sources for trading or high-stakes decisions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_market_data.py:64

Finding

Plaintext HTTP Enables Sector Market Data Manipulation

Content

View full analysis

Vulnerability Details

File Location: scripts/fetch_market_data.py, lines 64–68
Vulnerability Type: Plaintext HTTP transport for externally sourced market data
Risk Level: Medium

Vulnerable Code

python

def fetch_sector_rankings():
    """获取行业板块排名（同花顺）"""
    url = "http://q.10jqka.com.cn/thshy/"
    data = fetch_url(url)

Technical Analysis

The sector-ranking endpoint is accessed over unencrypted HTTP. HTTP provides neither transport confidentiality nor server authenticity, allowing an attacker with a network position—such as a malicious Wi-Fi operator, compromised proxy, ISP-level attacker, or local network adversary—to intercept and modify the response.

The application subsequently parses names and percentage values from the untrusted HTML without authenticating the response. Parsed sector names are returned through JSON or printed directly to a terminal. Consequently, a modified response can introduce false financial data or control characters into terminal output. The generic downloader also reads the complete response without a maximum size, while the parser applies broad regular expressions to the supplied HTML, increasing exposure to resource-consumption attacks.

Attack Path

1. A user invokes fetch_market_data.py.
2. The script requests http://q.10jqka.com.cn/thshy/ over plaintext HTTP.
3. A network-positioned attacker intercepts the request or response.
4. The attacker substitutes crafted HTML containing manipulated sector names and valid numeric percentage fields.
5. The regular-expression parser accepts the forged table data.
6. The script returns the falsified rankings in JSON or prints attacker-controlled sector names to the terminal.
7. If terminal control sequences or an oversized response are supplied, the attacker may additionally manipulate terminal presentation or cause excessive memory and CPU consumption.

Impact Assessment

Exploitation does not di ...[truncated 552 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the plaintext endpoint with the provider's verified HTTPS endpoint.
2. Reject redirects that downgrade an HTTPS request to HTTP.
3. Retain standard TLS certificate and hostname verification; do not introduce an unverified SSL context.
4. Enforce a maximum response size before loading the complete body into memory.
5. Validate the response content type and expected document structure before parsing.
6. Replace broad regular-expression HTML parsing with a bounded, maintained HTML parser.
7. Restrict sector names to an expected length and character policy.
8. Remove ASCII control characters and terminal escape sequences before printing externally sourced strings.
9. Where stronger integrity guarantees are required, obtain data from an authenticated API or validate responses using a provider-supported signature or trusted secondary source.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes a Python script that performs outbound network access to external market-data sites, but the manifest does not declare any tool scope or allowed network capability. This creates a permission-transparency gap: users and hosting platforms cannot reliably constrain or review what external access the skill requires, increasing the risk of unintended data exfiltration, policy bypass, or silent expansion of network behavior if the script changes later.

Content

No source excerpt is available for this finding.