yanmu-comps-model

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:48 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed financial comparison tool that fetches live stock prices and generates local charts, with ordinary but manageable setup risks.

Install in a dedicated virtual environment, review or pin the Python dependency versions before installing, and expect the script to contact Sina Finance for live quote data whenever it runs. Do not treat its output as investment advice.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6

Finding

Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 6
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet

bash

pip3 install matplotlib numpy

Technical Analysis

The installation command resolves mutable, unpinned versions of matplotlib, numpy, and their transitive dependencies from the Python package index configured in the user's environment. The project provides no lockfile, version constraints, package hashes, or trusted-index requirement.

Python package installation may execute package build or installation logic. Consequently, a compromised upstream release, transitive dependency, package-index account, or configured package mirror could cause attacker-controlled code to run during installation. The reviewed project does not itself identify a malicious package; the risk arises from unrestricted dependency resolution and insufficient supply-chain controls.

Attack Path

1. An attacker compromises a required package, one of its transitive dependencies, or a package source configured in the user's environment.
2. The user follows the documented setup instruction and runs pip3 install matplotlib numpy.
3. pip3 resolves and downloads the attacker-controlled distribution because versions and hashes are not constrained.
4. Malicious build or installation logic executes with the privileges of the user running pip3.
5. The installed package may execute further attacker-controlled behavior when scripts/comps_model.py imports numpy or matplotlib.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the installing user. This could permit access to files, credentials, environment variables, and network resources available to that account. It could also modify the user's Python environment or other user-writable resources. The exact scope depends on the installer's privileges; running the installation as an admini ...[truncated 142 chars]

Remediation

View remediation

Remediation Suggestions

1. Define reviewed, exact dependency versions in a lockfile or requirements file, for example:

   text

   matplotlib==<reviewed-version> --hash=sha256:<verified-hash>
   numpy==<reviewed-version> --hash=sha256:<verified-hash>
   

2. Include hashes for all direct and transitive dependencies and install with:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Generate and review the lockfile with a dependency-management tool that supports deterministic resolution.

4. Direct installation to an explicitly trusted package index rather than relying on ambient pip configuration.

5. Recommend installation inside a dedicated virtual environment under a non-privileged account.

6. Regularly scan locked dependencies for known vulnerabilities and update them through a controlled review process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documentation indicates network-capable behavior ('自动从新浪财经获取实时股价') but does not declare any explicit tool scope, permissions, or allowed-tools boundary. This creates a least-privilege and transparency problem: an agent or runner may permit broader network access than the user expects, increasing the risk of unintended outbound requests or future abuse if the script is modified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This Python file contains natural-language descriptions entirely in Chinese and presents the script as a Chinese-language modeling/reporting tool, with no indication that users may select another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The markdown says the script automatically fetches real-time market data, but it does not prominently warn the user before network access occurs. Even if the fetched data is low sensitivity, silent outbound requests reduce informed consent and can expose metadata such as usage timing, environment egress behavior, or enable dependence on untrusted external content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest focuses on comparable-company valuation and chart-based comparison, which is well matched by the database lookup and report generation. However, the implementation additionally reaches out to Sina Finance for live prices, introducing a runtime network data source that is not mentioned in the manifest description.

Content

No source excerpt is available for this finding.