T09 · Insecure Skill Coding Practices
Error
- Location
scripts/download_data.py:62- Finding
Unverified Remote Archive Extracted Without Path or Link Validation
- Content
View full analysis
- Remediation
View remediation
Security audit
Investment Data 1.0.0
Security checks for vulnerabilities and agentic risk
Overview
This skill is framed as reliable investment-data tooling, but its normal query path can return synthetic or placeholder financial data and its updater extracts remote archives unsafely.
Review this carefully before installing. Do not rely on its returned stock data for financial decisions unless the implementation is changed to read real verified datasets and clearly report provenance. Run downloads only in a contained directory and avoid scheduled updates until archive integrity checks, safe extraction, and subprocess path handling are fixed.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/data_client.py:168- Finding
Working-Directory and Interpreter Path Hijacking in Data Update
- Content
View full analysis
- Remediation
View remediation
other
Error
- Location
scripts/data_client.py:66- Finding
Fabricated Financial Data Returned as Investment Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (32)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
A description-behavior mismatch is security-relevant here because the skill claims to provide validated financial data while the implementation reportedly uses synthetic data, placeholders, hardcoded values, and undeclared subprocess/file-export behavior. In a financial context, users may make investment or automation decisions based on false outputs, while hidden execution and export capabilities increase the risk of unintended code execution, network access, and local data handling beyond the declared purpose.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill advertises high-quality, cross-validated A-share data, but multiple core methods are stubs, empty DataFrames, or hardcoded example values. This creates a broad integrity failure where consumers may rely on nonexistent or fabricated financial data, which is especially dangerous in a finance-oriented skill where trust and correctness are central.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The method claims to return stock daily data but actually fabricates values with numpy.random, which can mislead downstream users, agents, or trading workflows into treating synthetic data as real market data. In an investment-data skill, silent fabrication is security-relevant because it undermines integrity and can drive harmful financial decisions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README presents the skill description in Chinese and continues in that language, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate language or locale policy when a specific language is effectively forced without opt-in or justification.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill advertises and documents shell execution, environment variable use, and network-dependent operations, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where an agent may invoke broader capabilities than users expect, especially because the skill includes download, update, and export workflows that can change local state and access external resources.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description lists activation terms such as “股票数据”, “金融数据”, and “量化数据”, which are broad category labels rather than narrowly scoped invocation phrases. Without constraints, negative examples, or context limits, the skill could be invoked for many generic finance questions beyond this skill’s intended A-share dataset retrieval purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill documents automatic downloading and updating, but it does not clearly foreground that these actions require network access and modify local storage. This reduces informed consent and can lead to unexpected external connections, scheduled activity, or disk changes, which is more sensitive in agent environments where users may assume read-only data lookup.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Natural-language content in the module docstring and method descriptions is presented only in Chinese, and no alternative language option or locale justification is provided. This can violate language or locale policy where skills should not force a specific language without user opt-in.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
A data-query client unexpectedly includes an update path that executes a local script, expanding its privilege and behavior surface from read-oriented access to code execution. In this skill context, that mismatch is more dangerous because callers expecting passive data access may not anticipate side effects such as downloads, file changes, or execution of a compromised helper script.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The update operation executes an external script with only a generic log message and no confirmation, dry-run, or warning about side effects. In an agent skill, silent execution of update actions can surprise users and makes it easier for higher-level orchestration to trigger environment changes without informed consent.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 91% confidence
- Finding
The code invokes an external script via subprocess, which gives this data-query client local code-execution capability beyond simple data retrieval. Although the command is hardcoded and does not use shell=True, running another script can still trigger unintended side effects, dependency execution, or abuse if the referenced script or working directory is tampered with.
- Content
python logger.info("更新数据...") # 调用下载脚本 import subprocess result = subprocess.run( ['python', 'scripts/download_data.py', '--latest'], capture_output=True, text=True
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The export function writes to an arbitrary user-supplied path, which gives the skill file-write capability not implied by a simple data-query interface. While not inherently malicious, this can overwrite local files or place output in sensitive locations if exposed through an agent or untrusted caller, increasing the impact surface of the skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring and user-facing descriptions are written only in Chinese, and the script continues to present CLI help and status messages in Chinese. For a general-purpose download utility, this is a natural-language locale restriction without opt-in or an explicit justification that the tool is region-specific.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python def get_latest_release() -> str: """获取最新 release 版本""" url = "https://api.github.com/repos/chenditc/investment_data/releases/latest" resp = requests.get(url) resp.raise_for_status() data = resp.json()
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This Python file contains only Chinese natural-language content in the module docstring, comments, and user-facing print messages. That creates a locale-specific experience without offering a language choice or documenting why the skill is intentionally Chinese-only, which matches the language/locale policy violation criteria.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The quick-start section instructs users to download the latest data, which will write files locally, but the nearby instructions do not explicitly warn that this operation modifies local storage. Although storage size is mentioned later in the notes section, the operational steps themselves lack a clear user-facing warning about file creation and disk usage.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The export command and later CSV-writing example create files on disk, but the README does not warn users that output files will be created or may overwrite existing files in the target location. For markdown guidance, operations affecting user data should be accompanied by clear warnings about file-system impact.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The natural-language description and headings are entirely in Chinese, and the file does not indicate that the skill is China-region-specific from a language-policy perspective or offer an alternative language option. Under the policy, forcing a specific language without opt-in can be a locale-policy violation unless clearly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The file uses Chinese-only natural-language labels and comments throughout, such as the title and field descriptions, without indicating that the skill is region-specific or that users can choose another language. Under the language/locale policy rule, this can be a policy concern when a specific language is imposed without opt-in or explicit justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file is natural-language documentation, and all headings and descriptions are presented only in Chinese. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in or justification.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The dependency is specified with a lower bound only, allowing future installs to resolve to different versions over time. This creates a supply-chain risk and makes builds non-reproducible, which is especially relevant for a data-processing skill that depends on complex third-party libraries.
- Content
text pandas>=2.0.0 numpy>=1.24.0 requests>=2.31.0 pyyaml>=6.0
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
Using an unpinned numpy version means installations may silently pull in newer releases with security or stability regressions. In a financial-data skill, unpredictable dependency resolution can affect both integrity and exposure to vulnerable package versions.
- Content
text pandas>=2.0.0 numpy>=1.24.0 requests>=2.31.0 pyyaml>=6.0 openpyxl>=3.1.0 # Excel 导出支持
Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
An unpinned requests dependency is a real supply-chain weakness because the package handles outbound HTTP and has had security advisories in the past. Allowing arbitrary newer compatible versions increases the chance of pulling a release with an unresolved or newly introduced flaw.
- Content
text pandas>=2.0.0 numpy>=1.24.0 requests>=2.31.0 pyyaml>=6.0 openpyxl>=3.1.0 # Excel 导出支持
Static analysis
No suspicious patterns detected.