T09 · Insecure Skill Coding Practices
Error
- Location
scripts/closing-summary.mjs:319- Finding
Shell Command Injection Through API-Controlled Report Content
- Content
View full analysis
- Remediation
View remediation
Security audit
A Stock Evening
Security checks for vulnerabilities and agentic risk
Overview
This skill generates A-share market reports, but its send path uses an unsafe shell command and always sends to a hard-coded Feishu recipient.
Review before installing. Local report generation is relatively contained, but do not use --send or the documented cron job unless the recipient is made configurable and the shell command is replaced with a non-shell argument-array call such as execFile/spawn. Confirm where Feishu messages go before enabling recurring delivery.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/closing-summary.mjs:321- Finding
Hard-Coded Feishu Recipient Causes Unauthorized Message Delivery
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/closing-summary.mjs
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/closing-summary.mjs
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README explicitly instructs users to run the script with a flag that sends generated market reports to Feishu, but it does not clearly warn that this causes outbound transmission of report contents to an external service. Even if the data is only market-derived, generated reports may include organization-specific commentary, prompts, or derived insights, so the lack of disclosure can lead to unintentional data exfiltration or policy violations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The cron example documents unattended automatic sending of reports to Feishu every trading day without warning users about repeated outbound transmission. Scheduled delivery increases risk because data can be sent continuously after initial setup, making accidental leakage, misrouting, or compliance issues harder to detect and stop.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly documents sending generated market summaries through a Feishu channel but provides no user-facing warning, consent step, or disclosure about external transmission. Even if the content is mostly market data, reports may include user-specific context, preferences, or derived analysis, and transmitting them to a third-party messaging platform expands data exposure and audit requirements.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script invokes an external CLI via execSync to transmit generated content off-host, which expands its capability from local report generation into privileged outbound messaging. Using shell-command construction for message delivery also increases risk because future changes to the message content or recipient handling could introduce command injection or unauthorized data egress.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The hard-coded Feishu user ID causes all sent reports to be delivered to a fixed recipient without runtime approval or clear ownership validation. In a reusable skill, that creates a covert exfiltration path for generated content and operational metadata to an arbitrary account controlled outside the user's environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Outbound transmission to a fixed Feishu recipient occurs without meaningful user-facing disclosure of who will receive the data. Even if the payload is only market commentary, undisclosed external delivery violates transparency expectations and could expose derived business information, timestamps, or future expanded payloads.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The skill's natural-language instructions are entirely in Chinese and specify a single locale/timezone context, but do not indicate that this is optional or region-specific by design. That can violate language/locale choice expectations unless the documentation explicitly states the tool is intended only for Chinese A-share market users.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The report time/date formatting is forced to use the zh-CN locale, and the script content is written entirely in Chinese, with no opt-in or configuration for other languages/locales. The policy requires flagging language or locale constraints when they are imposed without user choice unless clearly documented as justified for a region-specific tool.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/closing-summary.mjs:322