T09 · Insecure Skill Coding Practices
Error
- Location
references/web-dashboard-setup.md:52- Finding
Production Dashboard Transmits Financial News Over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
新闻流事件驱动选股系统
Security checks for vulnerabilities and agentic risk
Overview
The skill’s core news-analysis purpose is coherent, but it needs Review because it can auto-send financial text to a third-party API and its deployment guidance exposes a plaintext, unauthenticated public analysis service with root-based server updates.
Install only if you are comfortable sending analyzed news text to Baidu Qianfan and can control when the skill runs. Before production use, require explicit user confirmation, avoid confidential or embargoed inputs, serve the dashboard only over HTTPS, add authentication/rate limits/body-size limits to /api/analyze, and replace root SSH deployment with a least-privileged deploy account.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
references/web-dashboard-setup.md:64- Finding
Public Analysis Endpoint Lacks Documented Authentication and Abuse Controls
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/web-dashboard-setup.md:167- Finding
Deployment Workflow Uses Unnecessary Remote Root Access
- Content
View full analysis
:/var/www/event-driven/ scp ~/.hermes/skills/quant-finance/wq-news-event-driven-stock-pick/scripts/news_analyzer.py root@:/var/www/event-driven/ # Restart service ssh root@ "systemctl restart event-driven" ``` The Skill also recommends root access for React deployment: ```bash scp EventDrivenTrader.tsx root@:/fintech/my-app/src/pages/ scp router.tsx root@:/fintech/my-app/src/app/ ssh root@ "systemctl restart fintech-frontend" ``` ### Technical Analysis Uploading application files and restarting specific services do not require unrestricted remote root access. The documented workflow grants the deployment identity complete administrative control over the host rather than only the permissions needed to update designated application directories and restart designated services. This increases the consequences of: - Theft of the deployment SSH credential. - Compromise of the deployment workstation. - Operator mistakes. - Malicious or compromised application files. - Command substitution or automation errors in a broader deployment pipeline. The static scan warning referred to SSH-related operations, but the project does not read, generate, or modify SSH keys. The issue is the excessive privilege of the recommended remote account, not hidden SSH-key access. ### Attack Path 1. An attacker compromises the deployment workstation or obtains its SSH private key or agent access. 2. The attacker authenticates to the ECS host using the documented `root` account. 3. Root access permits modification ...[truncated 1070 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (17)
Tainted flow: 'req' from os.environ.get (line 116, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python ) try: with urllib.request.urlopen(req, timeout=120) as resp: result = json.loads(resp.read().decode("utf-8")) return result except urllib.error.HTTPError as e:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly sends financial news content to Baidu Qianfan for analysis but does not clearly warn users that submitted data leaves the local system and is processed by a third-party service. If users include proprietary research, internal notes, or embargoed market-moving information, this could cause confidentiality, compliance, or data-governance issues.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README says the skill auto-triggers when financial news is sent in the "新闻流事件驱动选股" group, which imposes a specific language/locale condition. There is no indication that users may choose an English equivalent trigger or opt into this locale-specific behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README states that user-supplied financial news is sent to the Baidu Qianfan API for NLP analysis, but it does not clearly warn users that their input will leave the local environment and be processed by a third party. In a finance workflow, users may paste proprietary research, client information, or embargoed market-sensitive text, so the lack of explicit disclosure and consent creates a real privacy and data-governance risk.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documents capabilities that read local files, invoke external Python scripts, and send data to a third-party API, but it does not declare any explicit tool scope or permissions boundaries. This creates an authorization and review gap: operators and users cannot easily tell what resources the skill may access, and an agent runtime may grant broader powers than necessary.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger conditions are extremely broad, including essentially any finance-, policy-, industry-, or company-related text in a group chat. This can cause accidental activation on routine conversation or pasted content, leading to unintended data processing, unnecessary external API calls, and higher risk of prompt injection via untrusted text.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs sending news text to Baidu Qianfan for analysis but does not clearly warn users at the point of use that their supplied content will leave the local environment. This creates a data disclosure risk, especially if users paste proprietary research, internal messages, or unpublished market-sensitive information.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill's stated purpose is news-driven stock analysis, but the documentation significantly expands into running a local/remote web service, nginx routing, SPA integration, and operational deployment guidance. This scope expansion increases attack surface beyond the declared function, making it easier for the skill to influence hosting, routing, and service behavior unrelated to simple analysis.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation includes remote administration actions such as scp/ssh as root and restarting services on a public ECS server, which are not necessary for ordinary stock-picking analysis. If an agent follows these instructions, it could modify production infrastructure or overwrite files on a remote host, turning a content-analysis skill into a deployment pathway.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document explicitly describes sending user-entered news text to an external Baidu Qianfan API, but it does not mention user consent, privacy notice, data classification, or restrictions on pasting confidential information. This creates a real data-handling risk because users may unknowingly transmit sensitive market research, internal notes, or regulated information to a third-party service.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md 排查步骤： 1. 确认服务运行中：本地 `python3 app.py` / 线上 `systemctl status event-driven` 2. `curl http://localhost:5566/api/health` 应返回 `{"status":"ok"}` 3. 线上：`curl http://racingai.top/api/health` 4. 测试分析接口：`curl -X POST http://racingai.top/api/analyze -H 'Content-Type: application/json' -d '{"text":"央行降准0.5个百分点"}'` 5. 浏览器 F12 控制台检查 fetch 请求是否发出、是否有 CORS 错误
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file's natural-language interface, usage text, and system prompt are written entirely in Chinese and instruct the model to produce Chinese-language output, with no opt-in or language selection mechanism. This constitutes a locale/language policy issue because the skill enforces a specific language rather than offering a user choice or clearly documenting a necessary regional constraint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script sends full news text to a third-party LLM API without a clear user-facing disclosure at runtime about external transmission, retention, or privacy implications. If users provide proprietary research, embargoed news, or internal notes, sensitive data may be exposed to an external service contrary to user expectations or policy.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire template, including headings, warnings, and labels, is fixed in Chinese. This imposes a specific language/locale on all generated reports, and the file does not indicate any user opt-in or configurable language selection.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The Security section states that scripts/news_analyzer.py reads QIANFAN_API_KEY from the environment and exits with an error if it is not set. Earlier, the Features section says the system has a degradation mechanism that falls back to inline analysis when the Qianfan API is unavailable, which conflicts with an unconditional exit-on-missing-key description and creates a documentation-level contradiction about runtime behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The README says the agent will automatically trigger when users post financial news in the '新闻流事件驱动选股' group, and the primary documentation is Chinese-focused. This suggests a locale/language-specific operating assumption without explicit opt-in or a documented justification for restricting behavior to that language/context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Natural-language policy violations apply to all file types, including markdown. This file forces a specific language/locale for all instructions and operational guidance, with no opt-in, alternative language, or explanation that the skill is intentionally Chinese-only or region-specific.
- Content
Static analysis
No suspicious patterns detected.