Dawn Proactive Agent v1.5

• Outcome: Review
• Latest audit: Jul 9, 2026 · 9:55 PM UTC
• Version: 1.5.0

Overview

This looks like a trading automation skill rather than malware, but it needs review because it can execute paper-trading orders, run other local skills, persist trading decisions, and use broader local/network resources than its metadata clearly scopes.

Review before installing. Use it only with a sandbox or paper-trading account, do not schedule it or run --execute until you have verified the sibling skills it invokes, and assume audit/state files may contain sensitive portfolio strategy data. Update the network allowlist and add explicit confirmation, retention, and redaction controls before using it in any real trading workflow.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        env = os.environ.copy()
        env["PYTHONIOENCODING"] = "utf-8"
        result = subprocess.run(
            ["py", "-X", "utf8", HTSC_QUERY, "queryIndicator", 
             "--query", f"{code}{name}今天MACD、KDJ、RSI、换手率、主力资金流向"],
            capture_output=True, text=True, encoding="utf-8", timeout=30,

• Confidence: 89% confidence
• Finding: The script executes a separate local skill via subprocess using a fixed path under the user's home directory. Although it does not use shell=True and the immediate arguments here are mostly constant, it still creates a trust boundary crossing: any tampered or malicious sibling skill at that path will execute with the current user's privileges and its output is implicitly trusted as JSON and trading intelligence.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The skill presents itself as an ETF trading architecture with guardrails, but the documented behavior extends into direct order execution, broader stock-selection strategies, large-scale data collection, external scraping, and vector-memory retrieval. This mismatch is dangerous because users may grant trust and permissions based on a narrower description than the system's actual capabilities, increasing the risk of unintended trades, data exfiltration, or uncontrolled autonomous behavior.

Intent-Code Divergence

Low

• Confidence: 96% confidence
• Finding: The daily risk report displays the total portfolio weight using the single-position limit constant instead of the configured total-weight limit. In a trading guardrail component, misleading risk reporting can cause operators or downstream agents to believe aggregate exposure is compliant when it is not, weakening oversight and potentially enabling overexposure.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This monitoring skill delegates work to an external sibling skill located in a user-writable directory, expanding the attack surface beyond the current file. In this context, the monitor consumes the sibling skill's output and incorporates it into analysis and saved reports, so compromise of the sibling skill can mislead decisions or run arbitrary code under the user's account.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The `h_surprise()` handler performs workspace-wide recursive scanning (`rglob`) and compiles every Python file under `scripts/`, which exceeds the stated ETF trading scope and gives the skill generalized maintenance and inspection capability over the whole workspace. In an agent setting, this broader visibility can expose unrelated files, consume resources, and create an unexpected pathway for acting on data outside the intended domain.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: `auto_verify()` marks a decision as verified and records that 'Cron任务已部署' based only on the existence of `scripts/dawn_proactive.py`, which does not validate scheduler configuration or execution. This creates a false audit trail and can cause operators or downstream automation to trust that a periodic task is active when it is not, undermining safety controls and operational assurance.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill documents scheduled autonomous trading actions and manual trade execution without an explicit warning that it can trigger financially consequential operations. In the context of an autonomous agent with cron-style execution and network access, lack of prominent risk disclosure and confirmation boundaries materially increases the chance of accidental or poorly supervised trades.

Missing User Warnings

High

• Confidence: 90% confidence
• Finding: The document presents autonomous trade execution, order placement, and guardrail approval as normal operational behavior without any explicit warning that real financial transactions may be initiated automatically. In an agent skill context, this can normalize or encourage unattended trading and lead operators to enable unsafe automation without informed consent, risk limits, or human approval.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The health check records a large-scale deletion and commit of 1,237 archive files without clarifying scope, reversibility, or safeguards. In an autonomous or self-healing agent setting, descriptions of bulk destructive actions without warnings can mask risky maintenance behavior and make unsafe cleanup operations seem acceptable.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The function persists detailed decision inputs, free-form reasoning, outputs, and metadata to disk in per-decision JSON files and an index, with no consent flow, redaction policy, access control, or retention safeguards. In an autonomous trading agent, these records can capture sensitive portfolio data, API-derived market data, internal strategy logic, and chain-of-thought-style reasoning that materially increases privacy, confidentiality, and model-introspection risk if the filesystem is accessed or logs are exfiltrated.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The script will submit market buy/sell orders whenever run with --execute, with no confirmation prompt, interlock, preview approval, or secondary verification. In a trading skill, this is dangerous because a mistaken invocation, poisoned upstream data, or flawed recommendation logic can directly trigger unauthorized or harmful transactions.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script sends outbound requests to multiple third-party services (Tencent, Eastmoney, and potentially pywencai) without any explicit user disclosure, consent flow, or clear documentation of what data leaves the environment. In an agent-skill context, silent network access is risky because it can violate privacy expectations, leak usage patterns or identifiers indirectly, and expand the trust boundary to external providers.

Static analysis

No suspicious patterns detected.