A Stock Premarket Briefing

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:58 AM UTC
• Version: 1.0.1

Overview

This is a disclosed A-share premarket briefing helper, with manageable risks around external dependency installation and broad market-query triggers.

Install only if you are comfortable with the skill performing networked market-news searches and running a locally installed summarize executable. Prefer pinning or verifying dependency versions and treat the generated watchlists and market bias as informational, not financial advice.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:10

Finding

Unpinned Third-Party Dependencies from External Package Sources

Content

View full analysis

Vulnerability Details

File Location: README.md:10-11; duplicated in SKILL.md:113-114. The externally installed executable is invoked at scripts/a_stock_premarket_briefing.py:107-112.

Vulnerability Type: Unpinned and insufficiently verified third-party dependencies

Risk Level: Medium

Vulnerable Code

Installation instructions in README.md:10-11:

bash

pip install requests
brew install steipete/tap/summarize

Equivalent installation instructions in SKILL.md:113-114:

bash

pip install requests
brew install steipete/tap/summarize

The installed summarize executable is subsequently trusted and invoked in scripts/a_stock_premarket_briefing.py:107-112:

python

result = subprocess.run(
    ["summarize", url, "--extract-only", "--json"],
    capture_output=True,
    text=True,
    timeout=self.timeout
)

Technical Analysis

The setup documentation directs users to install requests without a pinned version or package hash and to install the summarize executable from the external Homebrew tap steipete/tap, also without pinning it to a reviewed version or source revision.

Consequently, the code ultimately executed may differ from the version reviewed during this audit. If a package publisher, custom tap, release artifact, maintainer account, or dependency-resolution channel is compromised, following the documented installation procedure could install altered code. The application later resolves summarize through the process environment's executable search path and runs it as a local process.

The use of an argument list rather than shell=True appropriately prevents direct shell metacharacter injection through the URL argument. The issue is therefore not command injection in the shown call; it is the trust placed in an unpinned and insufficiently verified external executable.

Attack Path

1. An attacker compromises a dependency publisher, the custom Homebrew tap, a release artifact, or another relevant ...[truncated 1655 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin Python dependencies to explicitly reviewed versions rather than allowing unrestricted resolution.
2. Maintain a lock file and require cryptographic hashes, such as a hash-locked requirements.txt installed with pip install --require-hashes -r requirements.txt.
3. Pin the Homebrew formula or source to a reviewed release or commit where the distribution mechanism permits it.
4. Document the authoritative upstream repository and verify release checksums or signatures before installation.
5. Avoid recommending privileged package installation unless it is strictly necessary.
6. Resolve and validate the expected summarize executable path before invocation, and document how users can verify the installed binary's provenance and version.
7. Add automated dependency and supply-chain scanning for lock-file changes and external package updates.
8. Review and update dependency pins deliberately, recording the reviewed versions and integrity metadata in the repository.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The README presents the skill name, usage instructions, and invocation phrases entirely in Chinese, implying a fixed language mode for interacting with the skill. There is no indication that users may choose another language or locale, which can violate language/locale choice expectations unless explicitly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger phrases shown in the README are broad, natural-language requests such as '生成盘前分析报告' and '今天市场主线是什么', which can easily overlap with ordinary conversation about markets. In an agent environment, this can cause unintended skill activation, routing user prompts into a tool-enabled workflow that performs web searches and generates investment-style analysis when the user may have only wanted general discussion.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises executable usage (python3 scripts/a_stock_premarket_briefing.py), external package installation, and network-dependent data collection, but does not declare any explicit tool scope such as allowed tools or permissions. This creates an authorization gap where a host agent may invoke shell and network capabilities more broadly than intended, increasing the risk of unintended command execution or overbroad external access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The trigger phrases are broad enough that ordinary market-related user queries could activate the skill even when the user did not intend a networked, shell-capable workflow. In a skill that gathers external financial information and may execute scripts, loose activation boundaries can cause unnecessary tool use, increased exposure to untrusted content, and accidental invocation in the wrong context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s natural-language description and all user-facing output specify a Chinese A-share premarket briefing workflow and Chinese-language interaction, but nowhere offers opt-in for another language or explains that the skill is intentionally region-specific for compliance or market-scope reasons. Under the policy, forcing a specific language/locale without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes a skill that analyzes market news and generates a premarket report by integrating search and summarization, but the code imports subprocess and later uses it to invoke an external CLI. Spawning local processes is a materially broader capability than the stated business purpose and is not justified by the manifest text itself.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/a_stock_premarket_briefing.py (reported line 107)May include surrounding context.

python

for url in urls[:10]:  # 限制提取数量
            try:
                # 调用 summarize CLI
                result = subprocess.run(
                    ["summarize", url, "--extract-only", "--json"],
                    capture_output=True,
                    text=True,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

These lines run an external program via subprocess to process URLs. For a skill presented as a market-news briefing tool that integrates search and summarization, local command execution is not an obvious or necessary capability from the manifest and creates a broader operational surface than described.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This Python file contains user-facing descriptions, report content, and warnings exclusively in Chinese, including the generated output and docstrings. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue when no choice or justification is provided.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The direct-request examples include “今天市场主线是什么”, which is a common market question and does not clearly distinguish premarket A-share briefing from broader analysis tasks. This creates ambiguity about when the skill should activate versus when another market-analysis skill should be used.

Content

No source excerpt is available for this finding.