Security audit

yanmu-dcf-model

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed DCF finance-modeling helper that fetches live stock quotes and writes a heatmap image, with no evidence of hidden persistence, credential access, or destructive behavior.

Install only if you are comfortable with a finance script making outbound requests to Sina Finance for quote data and writing chart files into the chosen output directory. Treat its valuation output as modeling support, not investment advice.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill explicitly describes automatic retrieval of live stock prices from a Sina Finance API, which is a network capability, but the manifest shown does not declare any permissions or allowed tool scope. Undeclared network access weakens user and platform visibility into what the skill can do and may enable unexpected outbound requests, data exfiltration, or policy bypass if executed in a broader agent environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The natural-language content throughout the file requires Chinese proficiency, and there is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy when a skill implicitly forces a specific language without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file-level description and all user-facing output strings are written in Chinese, indicating the skill is designed to operate in a fixed language/locale. The policy allows locale constraints only when explicitly justified or when the user is given a choice, neither of which is present here.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill advertises DCF modeling but also makes an undeclared outbound network request to Sina Finance to fetch live prices. Hidden external connectivity matters in an agent skill because it changes the trust boundary, can leak usage metadata, introduces dependency on third-party content, and can produce nondeterministic results that users did not consent to.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The script writes a heatmap image to disk even though the skill description does not mention filesystem side effects. Undisclosed file creation is a security-relevant behavior in agent environments because it can overwrite user expectations, leak analysis artifacts into shared workspaces, or interact badly with privileged directories if the output path is user-controlled.
Content: No source excerpt is available for this finding.