KRX Stock CLI

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:47 AM UTC
• Version: 0.1.0

Overview

This skill is a straightforward market-data CLI with disclosed public-data dependencies and no evidence of hidden persistence, credential use, destructive behavior, or agent instruction hijacking.

This appears safe to install for public market-data lookup. Users who need reproducible or higher-assurance environments should pin and hash the Python dependencies before installing, and should treat outputs as informational market data rather than trading advice.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Unpinned and Unhashed Runtime Dependencies

Content

View full analysis

Vulnerability Details

File Location: scripts/requirements.txt:1-2
Vulnerability Type: Supply-chain exposure through mutable dependency resolution
Risk Level: Medium

text

finance-datareader>=0.9.96
pandas>=2.0

Technical Analysis

Both runtime dependencies use open-ended minimum-version constraints and have no integrity hashes. Consequently, the installation command documented by the project resolves whichever compatible releases are available from the configured package index at installation time. The installed code can therefore change without any modification to this audited project.

The absence of exact version pins and artifact hashes prevents users from verifying that they are installing the dependency versions reviewed and tested by the project. It also increases exposure to compromised package releases, maintainer-account compromise, malicious dependency updates, and incompatible upstream changes. The dependencies are imported when scripts/krx.py starts, so code contained in a selected package executes under the invoking user's account at runtime.

Attack Path

1. An attacker compromises an upstream dependency release process, maintainer account, distribution artifact, or one of its transitive dependencies.
2. The attacker publishes a newer release that still satisfies finance-datareader>=0.9.96 or pandas>=2.0.
3. A user follows the documented installation process and runs pip install -r scripts/requirements.txt.
4. Pip resolves and installs the attacker-controlled compatible release because no exact version or hash is required.
5. The malicious package code executes when the CLI imports the affected dependency or invokes its functionality.

Impact Assessment

Malicious dependency code would execute with the same operating-system privileges as the user installing or running the CLI. Depending on those privileges and the execution environment, it could read or mod ...[truncated 375 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace open-ended constraints with exact, reviewed versions using ==.
2. Generate and commit a lock file containing all transitive dependency versions.
3. Record SHA-256 hashes for every permitted distribution artifact and install with pip --require-hashes.
4. Perform dependency updates through a controlled review process that includes vulnerability scanning and regression testing.
5. Use a trusted package index and explicitly configure the index source to reduce dependency-confusion exposure.
6. Rebuild locked dependencies periodically so security fixes can be adopted without silently accepting unrelated future releases.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/krx.py:140

Finding

Search Input Is Evaluated as a Regular Expression

Content

View full analysis

Vulnerability Details

File Location: scripts/krx.py:140-142
Vulnerability Type: Unintended regular-expression evaluation of user-controlled input
Risk Level: Low

python

hits = df[df["Name"].str.contains(q, na=False, case=False)][
    ["Code", "Name", "Market", "Marcap"]
]

Technical Analysis

The search command is documented as a substring search, but pandas.Series.str.contains treats its pattern argument as a regular expression by default. The value q originates directly from the positional command-line argument:

python

q = args.query.strip()

A user can therefore supply arbitrary regular-expression syntax rather than a literal company-name substring. An invalid expression can cause regex compilation to fail. A sufficiently large or computationally expensive expression may also consume disproportionate CPU or memory while it is compiled or evaluated against the listing.

The top-level exception handler converts resulting failures into an upstream_error, but it does not prevent the affected invocation from failing. The finite stock-listing dataset limits the practical scope of regex evaluation, making this primarily a local availability and correctness issue rather than a privilege-boundary violation.

Attack Path

1. An attacker or untrusted caller controls the argument passed to python scripts/krx.py search.
2. The caller supplies malformed regex syntax, such as an unmatched [, or a deliberately expensive expression.
3. str.contains compiles the argument as a regex because regex=False is not specified.
4. A malformed expression terminates the search with an error; an expensive expression may increase CPU or memory consumption during that command invocation.
5. Any automation depending on successful search output receives an error instead of the documented substring-search result.

Impact Assessment

Exploitation does not grant additional privileges, acces ...[truncated 325 chars]

Remediation

View remediation

Remediation Suggestions

Disable regex interpretation for the documented literal substring search:

python

hits = df[df["Name"].str.contains(q, na=False, case=False, regex=False)][
    ["Code", "Name", "Market", "Marcap"]
]

Additionally:

1. Enforce a reasonable maximum search-query length.
2. Add tests covering regex metacharacters such as [, (, *, ., and \.
3. If regex search is intentionally added in the future, expose it through a separate explicit option, validate pattern length and complexity, and report malformed patterns as input-validation errors rather than upstream failures.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest and module docstring position this tool as a Korean Exchange/KRX market data CLI, and the manifest specifically names KOSPI/KOSDAQ/KOSPI200/KRX100 index histories. However, the curated index-list output also advertises U.S., Japanese, and Chinese indices such as DJI, IXIC, US500, N225, and SSEC, expanding the exposed functionality beyond the declared KRX-focused scope.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The inline comment says this is a curated list because FinanceDataReader does not expose a KRX index catalogue directly, which implies the list is serving as a KRX-focused substitute. The actual returned list includes Dow Jones, NASDAQ, S&P 500, Nikkei 225, and Shanghai Composite, contradicting that documented intent.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency specifier uses a lower bound only, which allows installation of any newer finance-datareader release without review. This weakens build reproducibility and can expose the skill to future breaking or compromised upstream releases through supply-chain drift, even though no specific vulnerable version is identified here.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

finance-datareader>=0.9.96
pandas>=2.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

pandas is also specified with only a minimum version, so installs are not deterministic and may pull in unreviewed future versions. In a CLI that processes external market data, this increases software supply-chain risk and makes it harder to verify whether known issues affect deployed environments.

Content

Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.

text

finance-datareader>=0.9.96
pandas>=2.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.