Security audit

yansheng-news-sentiment

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small teaching demo that fetches public stock pages and produces simplified sentiment output, with quality and disclosure limitations but no evidence of malicious behavior.

Install only if you are comfortable with a Chinese-language teaching demo that may contact Sina Finance using the stock codes you provide. Treat its sentiment scores as illustrative output, not investment analysis or reliable NLP.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior says the skill is a teaching/demo analyzer that does not rely on real-time news APIs, but the implementation reportedly performs live network access and derives outputs from remote stock/news pages. This mismatch is security-relevant because it hides external data flows, trust boundaries, and operational behavior from users and reviewers, increasing the risk of unintended data exposure, unreliable outputs, and policy evasion.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest description explicitly frames this as a teaching demo that does not rely on real-time news APIs. In practice, the script issues live HTTP requests to Sina Finance pages and derives counts from current remote content, which is materially broader than an offline or self-contained keyword-scoring demo.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill appears to use network access but does not declare any explicit tool scope or permissions in the manifest. Undeclared capabilities are dangerous because they bypass least-privilege expectations, making it harder for reviewers and users to understand that the skill may reach external sites and process untrusted remote content.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The docstring presents the file as a '新闻舆情分析脚本', which implies it analyzes sentiment of news content. However, the code only counts occurrences of 'news' in fetched HTML and then assigns fixed sentiment ratios, so the documented intent overstates what the code actually does.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script's natural-language strings and output are entirely in Chinese, and there is no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking context. This matches the policy category for language or locale constraints imposed without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This Python code makes an outbound HTTP request to a third-party site using the user-provided --codes value, but there is no docstring, comment, or user-facing message warning that input will be sent over the network. For code files, outbound transmission of user or system data should have some visible disclosure unless clearly communicated elsewhere.
Content: No source excerpt is available for this finding.