Security audit

Racing Quant AI 赛马量化AI选股系统

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent stock-analysis purpose, but it exposes live database credentials and mixes in trading, production-server administration, scheduler-state access, and unreliable financial output without enough control.

Do not install this as a general-purpose skill until the publisher removes and rotates the exposed database password, separates stock analysis from live trading and production operations, deletes scheduler prompt-recovery guidance, pins dependencies, and makes any trading workflow dry-run by default with explicit account, order preview, and confirmation steps.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (7)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/read-strategies.js:3
Finding: Hardcoded Credentials for an Internet-Accessible MySQL Database
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/fintech-codebase-structure.md:223
Finding: Production Administration Is Performed Through Unrestricted Root SSH
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:536
Finding: Instructions Expose Unrelated Agent Scheduler Prompts and Historical State
Content: View full analysis
/` 目录下的历史输出 .md 文件，其中 `## Prompt` 段落包含原始 prompt 全文 ``` ### Technical Analysis The Skill explicitly directs the Agent to read complete scheduler prompts and historical output from shared Agent-state paths. These resources may belong to unrelated jobs and can contain confidential user instructions, internal paths, report contents, access details, or embedded secrets. Reading complete prompt state is not necessary for quantitative stock analysis. It crosses task boundaries and creates a reconnaissance channel that could be abused by an attacker who can trigger the documented troubleshooting behavior. ### Attack Path 1. An attacker asks the Agent to diagnose or recover a scheduled analysis job. 2. The Skill directs the Agent to read `~/.hermes/cron/jobs.json`. 3. The Agent retrieves complete prompts for other scheduled jobs. 4. The attacker requests that the contents be displayed or incorporated into a report. 5. Sensitive instructions, operational details, or credentials from unrelated jobs are disclosed. ### Impact Assessment The issue can expose cross-session and cross-task Agent state available to the executing operating-system account. It does not independently grant root privileges, but it may reveal information useful for accessing other services or manipulating future scheduled workflows. ]]>
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/package.json:1
Finding: Runtime Dependencies Are Installed Without Reproducible Version and Integrity Controls
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/fintech-codebase-structure.md:157
Finding: Sensitive Application and Database Traffic Is Permitted Over Plaintext Transport
Content: View full analysis
`127.0.0.1:5173`（Vite dev server） - **注意**：`https://racingai.top` 会连接超时，需用 `http://` 访问 ``` Remote MySQL client configurations throughout `scripts/` also omit an `ssl` configuration while connecting to a public IP. ### Technical Analysis The deployment explicitly operates only over HTTP and instructs users to fall back to an unencrypted URL. Remote database clients likewise do not require TLS or validate a server certificate. Plaintext HTTP allows an on-path attacker to observe requests and responses or modify API and website content. Unprotected MySQL transport may expose queried portfolio data and is susceptible to network manipulation depending on server authentication and protocol configuration. Because financial analysis depends on the integrity of returned data, response tampering is particularly important even where no web login credential is transmitted. ### Attack Path 1. An attacker obtains an on-path position between the Agent and the website or database. 2. The Agent connects through HTTP or a non-TLS MySQL session. 3. The attacker records sensitive requests and portfolio responses. 4. The attacker modifies market, strategy, API, or application content in transit. 5. The Agent incorporates the manipulated information into analysis or operational decisions. ### Impact Assessment The exposure includes the confidentiality and integrity of website/API traffic and potentially remote database queries and results. Manipulated responses can corrupt investment reports, while observed traffic can disclose strategy identifiers, holdings, and operational metadata. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/dump_holdings_tmp.js:9
Finding: Portfolio Holdings Are Written to a Predictable Shared Temporary File
Content: View full analysis
({ date: r.trade_date, holdings: typeof r.trading_info === 'string' ? JSON.parse(r.trading_info) : r.trading_info })); fs.writeFileSync('/tmp/holdings_stgetf0001.json', JSON.stringify(result)); ``` Related workflow documentation uses additional fixed paths such as `/tmp/holdings.json`, `/tmp/etf_prices.json`, and `/tmp/backtest_option_d2.py`. ### Technical Analysis The script exports the full holdings history to a fixed filename in a shared temporary directory. It does not create a private temporary directory, request exclusive file creation, set restrictive permissions, verify file ownership, or remove the data when processing finishes. On a multi-user system, another local account may be able to read the file depending on the process umask. An attacker can also pre-create the path or a symbolic link. Because `writeFileSync` follows symbolic links, the process may overwrite a different file accessible to its account. Fixed cache files can also be replaced to manipulate subsequent backtest results. ### Attack Path 1. A local attacker predicts the fixed `/tmp/holdings_stgetf0001.json` path. 2. The attacker monitors the path, pre-creates a symlink, or later replaces its content. 3. The Agent runs the export script. 4. Portfolio history is disclosed, redirected to another file, or overwritten with attacker-controlled data. 5. A later backtest trusts the manipulated cache and produces false conclusions. ### Impact Assessment The issue can disclose proprietary historical portfolio holdings to local users and can compromise the integrity of backtesting and position-sizing repo ...[truncated 175 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/get-positions-correct.js:12
Finding: Analysis Script Emits Fabricated Financial Claims When Data Retrieval Fails
Content: View full analysis
📝 **来源：** 内置深度研究库`); console.log(`> ${defaultResearch[stock.name] || '暂无公开深度研究'}\n`); ``` ### Technical Analysis Despite its name and documented use, the script does not retrieve the requested strategy's holdings from the strategy database. It uses a fixed simulated portfolio and only changes the report title based on the user-supplied strategy name. When the external research search returns no result, the script emits unsupported quantitative claims about valuation discounts, institutional holdings, expected earnings contribution, institutional capital flow, and historical valuation per ...[truncated 1089 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (123)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a full quantitative stock selection and AI recommendation system. The provided code does not implement those functions. Instead, it is a simple diagnostic script that connects to an external MySQL database with hardcoded credentials, retrieves the most recent date from one named table, selects a single row for that date, and logs the contents. This is materially different from the stated purpose: there is no strategy filtering workflow, no retrieval and analysis of holdings beyond one raw row, no AI reasoning, and no recommendation output. The database access itself may be related to strategy data, but the actual behavior shown is limited to low-level inspection/debugging and includes undeclared direct access to an external database.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a full quantitative stock-selection and AI recommendation system. However, the supplied code only performs a low-level database connectivity and schema-inspection task: it connects to a remote MySQL instance and describes a single table. There is no implementation of strategy screening, portfolio retrieval, quantitative analysis, stock recommendation, or AI-driven evaluation. While database access could be a supporting detail for such a system, this specific code chunk’s actual behavior is materially narrower and different, and it includes an undeclared capability of schema enumeration against a remote database using hardcoded credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description claims an AI-powered quantitative stock selection and recommendation system that filters strategies based on user needs, retrieves holdings, performs deep analysis, and returns investment references. The code does not implement that broader workflow. Instead, it is a narrow audit/query script focused on one hardcoded stock code (300308), checking which strategies historically held it and listing latest top holdings for recommended strategies. It also uses undeclared external database access with embedded credentials. While the database/strategy-holdings theme is related, the actual behavior is materially narrower and different from the declared purpose, so this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a full quantitative stock-selection and AI recommendation system. The provided code does not implement those functions. Instead, it only connects to a remote MySQL database and inspects the structure of one table. While database access could be a supporting detail for such a system, this code chunk's actual behavior is limited to schema introspection and lacks any logic for selecting strategies, retrieving portfolio stocks, analyzing securities, or generating investment advice. This is therefore a material mismatch between declared purpose and observed behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents an end-user quant stock selection and AI recommendation system that screens strategies from a database, retrieves holdings, analyzes individual stocks, and outputs investment references. The supplied code does not implement that workflow. Instead, it performs a narrow data-extraction task: connect to a remote MySQL instance with hardcoded credentials, query one specific table, parse trading_info, and write the dataset to /tmp as JSON. This is materially different from the described primary purpose and introduces undeclared data-export/database-access behavior. While database access could be a supporting detail, the absence of any actual selection, recommendation, or analysis logic makes the implementation substantially mismatched to the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The declared description presents a broader end-to-end quant stock selection and AI recommendation system: selecting suitable strategies from a strategy database, obtaining constituent holdings, conducting deep analysis on individual stocks, and producing investment guidance. The supplied code does only one narrow step: connect to a remote MySQL database, fetch the latest holdings from a hardcoded table, parse the JSON payload, and print the positions. There is no strategy filtering logic, no user-need matching, no multi-strategy selection, no AI/ML inference in this snippet, and no downstream stock analysis or recommendation generation. Additionally, the code uses undeclared direct database access with embedded credentials, which is a materially relevant capability/resource access not reflected in the declared permissions. Therefore the description materially overstates and misrepresents what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description claims an integrated quantitative stock-selection and AI analysis system that filters strategies, retrieves portfolio holdings, deeply analyzes individual stocks, and outputs investment guidance. The supplied code does something much narrower: it opens a MySQL connection to a remote database, searches the strategy_information table using LIKE on a provided strategy name, and logs returned strategy details. There is no logic for retrieving actual held stocks from a position table, no quantitative screening workflow beyond a single metadata lookup, and no AI-driven stock analysis or recommendation generation. Additionally, the code uses direct remote database access with hardcoded credentials, which is a concrete capability not reflected in the declared permissions. Therefore the implemented behavior is materially narrower and operationally different from the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description promises a broader AI-driven quantitative stock selection system: selecting suitable strategies from a strategy database, obtaining holdings, then conducting deep per-stock analysis and producing investment recommendations. The actual code only performs one limited function: it connects to a specific remote MySQL database, reads the latest holdings from one hardcoded strategy table, sorts by weight, and prints the top 10 positions. There is no evidence of strategy screening by criteria, no AI recommendation logic, no deep analysis, and no end-to-end stock-picking workflow. Additionally, the code accesses a remote database with embedded credentials, which is a significant capability not reflected in the declared permissions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a full quant stock-selection and AI recommendation system centered on strategy database filtering, portfolio constituent retrieval, and deep investment analysis. The supplied code does none of that. It simply takes a fixed list of codes, calls Eastmoney's stock API endpoint, and prints name mappings for those codes. This is a materially different primary purpose and uses an external market data lookup resource rather than a quant strategy database. Therefore, the description does not accurately represent the code chunk's actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents a broader AI-driven quantitative stock selection system: selecting strategies based on user needs, obtaining held stocks, analyzing individual stocks, and producing investment guidance. The supplied code does something much narrower: it queries a remote MySQL database for strategies marked as recommended and prints their metadata. While database strategy selection is loosely related to the description, the actual behavior lacks the core advertised capabilities such as holdings retrieval, quantitative analysis, stock recommendation logic, or deep per-stock analysis. It also performs explicit remote database access with hardcoded credentials, which is a concrete capability not disclosed in the permissions. Therefore the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The description promises a broader 'quantitative AI stock selection system' that can filter suitable strategies from a strategy database, obtain held stocks, then conduct deeper intelligent analysis and produce investment references. The supplied code does only a narrow data-extraction task: it connects to an external MySQL server, queries one hardcoded strategy ID, enumerates historical rebalance dates, parses stored JSON holdings, and prints holdings snapshots. There is no strategy screening based on user requirements, no stock recommendation logic, no AI/deep analysis, and no final investment guidance generation. Additionally, the code uses undeclared external database access with hardcoded credentials, which is a materially undeclared capability/resource access.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a broader AI-powered quantitative stock selection system that searches a strategy database, filters suitable strategies, retrieves constituent holdings, and performs deep per-stock analysis to provide investment guidance. The supplied code does not do that. It connects directly to a MySQL database, queries one fixed table (strategy_huaxiaetftiming_stgetf0001), parses trading_info, and produces summary statistics such as monthly holding counts, ETF appearance frequency, and turnover by time period. It is focused on retrospective analysis of ETF holdings for a single strategy, not strategy screening, stock picking, intelligent recommendation, or deep analysis of individual securities. Additionally, the code performs database access not reflected in declared permissions. Therefore the description materially overstates and misrepresents the actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description promises a broader 'quant AI stock selection system' with strategy screening, stock-level retrieval, intelligent analysis, and final investment recommendations. The supplied code does something much narrower and different: it connects directly to a remote MySQL database, reads from one specific table (strategy_huaxiaetftiming_stgetf0001), parses holdings data, and computes descriptive statistics about ETF positions over time. There is no evidence of strategy search/filtering by user requirements, no stock recommendation logic, no AI/model inference, and no final recommendation generation. The asset focus is also different: the script analyzes ETF holdings, not individual stock picks. Because the code’s primary behavior is database-backed historical holdings analysis/reporting for one strategy, the declared description materially overstates and misrepresents the actual functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description is only partially accurate. The code does implement strategy-database screening, requirement keyword matching, retrieval of latest strategy holdings, and preparation of stock data for later analysis. However, its actual behavior is primarily a data access/query utility: it connects to an external MySQL server with hardcoded credentials, reads strategy and stock tables, and formats results for command-line output. The claimed '个股智能推荐分析 / 深度分析 / AI选股' is not present here; the 'analyze' path merely returns structured JSON for downstream analysis rather than performing actual AI analysis or recommendation. This is a material description-behavior mismatch because the declared primary experience emphasizes AI-driven analysis/recommendation, while the supplied code is mostly a database reader and formatter with simple keyword matching.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a broad AI-assisted quantitative stock selection and recommendation system. The actual code only performs a narrow database scan: it logs into a remote MySQL instance with hardcoded credentials, reads strategy metadata, checks each strategy's most recent trading_info for whether stock 688146 appears, and outputs matching strategies. It does not implement quantitative strategy screening based on user needs, does not perform deep analysis of individual stocks, and does not generate investment recommendations. While querying strategy holdings is loosely related to the declared domain, the primary behavior is materially narrower and different, and it also uses undeclared direct database access with embedded credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a broader 'quant stock selection + AI stock recommendation analysis' system that screens strategies from a database, retrieves holdings, deeply analyzes constituent stocks, and ultimately gives investment references. The supplied code does something narrower and materially different: it is a CLI utility for historical analysis of one specified strategy's holdings over a date range. It prints strategy metadata, trading dates, monthly snapshots, turnover changes, holding duration stats, and position-count stats. There is no evidence of AI analysis, stock recommendation, user-need-based strategy filtering, or final investment guidance. Additionally, the code directly accesses a remote MySQL database with hardcoded credentials, while declared permissions are empty. Therefore the description does not accurately represent the actual behavior.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The skill file contains hardcoded remote MySQL credentials, host, and database details, then instructs the agent to use them to retrieve and return database contents. This is a direct secret exposure and unauthorized data-access risk: anyone with access to the skill definition can reuse the credentials to query, exfiltrate, or abuse the remote database.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill extends from analysis into direct QMT trade execution, including generation of buy/sell instructions and actual order placement. In a financial context, this is highly dangerous because a user invoking what appears to be an analysis skill could trigger irreversible market transactions, causing direct monetary loss or unauthorized trading.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill describes live trade execution but lacks a prominent, explicit warning that orders may be placed and financial consequences may be immediate and irreversible. In financial tooling, absence of a strong execution warning and confirmation flow materially increases the risk of unauthorized or mistaken trades.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill includes production-debugging and software-maintenance instructions unrelated to stock screening, such as operational logging and backend troubleshooting. Mixing these capabilities into a user-facing finance skill unnecessarily broadens authority and could expose internal systems or enable unintended operational changes.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 355)May include surrounding context.
md
- `get-positions-correct.js`：获取策略最新正确持仓列表

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 590)May include surrounding context.
md
- `get-positions-correct.js`：获取策略最新正确持仓列表

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 356)May include surrounding context.
md
- `get-positions.js`：获取策略持仓列表（原始版）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 357)May include surrounding context.
md
- `get-positions-json.js`：获取持仓JSON格式

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 358)May include surrounding context.
md
- `get-position-table.js`：输出持仓表格

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/get-positions-correct.js:41