Security audit

Institutional Tracker Ai

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent stock-analysis tool, but it asks users to route credentials and market queries through arbitrary proxy endpoints and can run local helper scripts that are not clearly controlled.

Before installing, use only a trusted HTTPS Tushare endpoint, avoid unofficial proxy tokens unless you accept that provider seeing your token and queries, and rotate the token if it may have been exposed. Review or disable the NeoData and Xiaohongshu helper-script paths unless you trust those local installations. Treat generated HTML reports as untrusted if data comes from a proxy, and treat all trading signals as research rather than investment advice.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/data_fetcher.py:26
Finding: API Credential Transmitted to an Unrestricted Endpoint with Plaintext HTTP Explicitly Permitted
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:94
Finding: Stored HTML Injection Through Unescaped Proxy-Controlled Market Data
Content: View full analysis
0 else "#f44336" if info["raw_score"] < 0 else "#999" details_html += f'''

{dim_name}

{info["raw_score"]:+.0f}

{info["reason"]}

''' return f'''

{r[" ...[truncated 2761 chars]
Remediation: View remediation
``` 6. Avoid permitting remote images, scripts, frames, forms, and network connections in reports unless required. 7. Add security tests containing payloads such as `

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (31)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This mismatch is more serious because the finding alleges undisclosed external data collection and local subprocess execution that are not reflected in the declared purpose. If the skill actually invokes unrelated local scripts and pulls from additional external sources, users may unknowingly expose local environment context or send requests to third parties outside the stated Tushare-only workflow.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This mismatch is more serious because the finding alleges undisclosed external data collection and local subprocess execution that are not reflected in the declared purpose. If the skill actually invokes unrelated local scripts and pulls from additional external sources, users may unknowingly expose local environment context or send requests to third parties outside the stated Tushare-only workflow.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The file performs outbound network access to Tushare via urllib but the finding states this capability is not declared in permissions. Undeclared network access is dangerous because it can transmit prompts, stock identifiers, and API credentials to external services without platform governance or user awareness.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This skill reaches outside its core analytics logic to invoke a shell script for Xiaohongshu scraping, expanding the attack surface to arbitrary local tooling and whatever that script does. In the skill context, this is more dangerous because the feature is optional, loosely justified, and not essential to stock-signal generation, so it introduces execution risk unrelated to the main business purpose.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Overly broad triggers can cause the skill to activate for generic stock-analysis requests outside its intended scope, increasing the chance of unintended tool use, external API calls, and misleading financial outputs. In an agent setting, overbroad routing is a security and safety concern because it expands the conditions under which the skill can access tools and user queries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill does not clearly warn users that their market queries and token-authenticated requests will be sent to external endpoints, which creates a transparency and privacy risk. Even if the token is stored locally, request contents, symbols, timing, and usage patterns may still be disclosed to third-party services, and users are not adequately informed of that data flow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown file consists exclusively of Chinese-language instructions and descriptions, and it does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide explicitly instructs users to purchase and use a third-party 'proxy' Tushare token and API endpoint, then place that credential into code and send requests to an untrusted server. This creates a real credential and data-exposure risk: the proxy operator can observe tokens, request contents, queried symbols/date ranges, and potentially return manipulated market data, which is especially concerning in a trading-related skill where users may make financial decisions from the output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code file contains a Chinese-only module docstring, and the rest of the inline comments and user-facing guidance are also written in Chinese. Under the policy rule for natural-language violations, forcing a specific language without documenting user choice or a justified locale restriction is a reportable issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The code sends a Tushare API token in outbound requests without any visible user disclosure or consent flow. While API tokens are expected for authenticated services, silent credentialed network egress increases privacy and governance risk and may surprise users of the skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill is described as Tushare-centric stock analysis, but it also exposes a generic subprocess-backed query path to an external helper script. That broadens the trust boundary and can enable unexpected data access or behavior outside the stated purpose, especially if the helper script itself performs arbitrary network queries or processing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The code executes an external Python script without any user-facing warning, creating hidden execution of auxiliary logic beyond the main file. Even though the subprocess invocation is not shell-based, this still expands the attack surface because the child script may perform network access, file access, or other sensitive actions outside the user's expectations.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/data_fetcher.py (reported line 195)May include surrounding context.
python
def query(self, query_text: str, data_type: str = "api") -> dict: try: result = subprocess.run( ["python3", str(NEODATA_SCRIPT), "--query", query_text, "--data-type", data_type], capture_output=True, text=True, timeout=30 )

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script's comments and all user-visible status messages are presented in Chinese, with no indication that another language is available or that the locale requirement is intentional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The top-level natural-language documentation is entirely in Chinese and presents the skill as operating in that language/context by default, with no indication that users may opt into another language. Under the policy, language or locale constraints should be optional or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest frames the skill as based on Tushare structured data plus defined signal dimensions, while this module explicitly aggregates external media/social sources including YouTube RSS, Eastmoney news/hotness, and Xiaohongshu replacement logic. External sentiment enrichment may be useful, but it is a broader behavior than the manifest's primary '基于Tushare结构化数据' description suggests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code file contains natural-language documentation and output strings entirely in Chinese, presenting the skill as Chinese-only by default. The policy requires flagging language or locale constraints when the skill forces a specific language without offering the user a choice or documenting a justified region-specific limitation.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 92% confidence
Finding: The code executes an external script from a user-writable home-directory path (~/.workbuddy/skills/xiaohongshu/scripts/search.sh) without validating integrity, origin, or permissions. Even though shell=True is not used, this still creates a code-execution trust boundary: if that script is replaced or tampered with, the skill will run attacker-controlled code whenever sentiment aggregation is invoked.
Content: Scanner excerpt · scripts/sentiment_aggregator.py (reported line 573)May include surrounding context.
python
if os.path.exists(mcp_script): try: result = subprocess.run( [mcp_script, "A股买入"], capture_output=True, text=True, timeout=15 )

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The module-level docstring and all user-facing descriptive text are written exclusively in Chinese, and later return strings are also hard-coded in Chinese. This imposes a specific language/locale without any opt-in or documented justification, which matches the policy-violation category for language constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This file contains user-facing natural-language content in docstrings and comments exclusively in Chinese, including the module description and class documentation. Under the stated policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: Natural-language policy violations include forcing a specific language or locale without user opt-in. Nearly all user-facing documentation is in Chinese, and the README does not offer an alternative language or explicitly frame the locale/language restriction as an intentional China-market-only scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: For markdown files, missing-warning findings apply when the skill description omits warnings about behaviors affecting privacy or system integrity. The data source section states that a Tushare proxy token is required, which implies use of an external service and credential handling, but the README provides no warning about safeguarding the token or that market/system data may be sent to that service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: SQP-3 applies to all file types and includes language or locale policy violations. This file presents all instructions and methodology exclusively in Chinese without stating that the user can choose another language or that the locale restriction is intentional and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file contains user-facing natural language only in Chinese, and there is no indication that users may choose another language or that the locale restriction is required. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The module docstring at L003-L009 says this is '大规模回测验证 v3' and lists v3 improvements, but the runtime banner at L409 says '大规模回测 v2'. This is an intent/documentation inconsistency that can mislead users about which algorithm version is actually being executed.
Content: No source excerpt is available for this finding.