Security audit

A Stock Morning

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does the advertised market-summary task, but it runs an unreviewed hardcoded local Tavily skill script through a shell and does not clearly document that dependency.

Review before installing. The Feishu messaging behavior is expected, but this package depends on a separate local Tavily search skill at a hardcoded path and runs it as a shell command. Only use it if you trust that external script and understand that a cron setup will repeatedly send generated market summaries to Feishu.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: scripts/morning-summary.mjs:89
Finding: Execution of an Unverified External Tavily Search Component
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/morning-summary.mjs:36
Finding: Unbounded and Untimed Tencent API Response Handling
Content: View full analysis
{ const url = `https://qt.gtimg.cn/q=${code}`; https.get(url, (res) => { let data = ''; res.on('data', chunk => data += chunk); res.on('end', () => { try { // 解析腾讯股票数据格式 const match = data.match(/v_.*?="(.+?)"/); if (match) { const parts = match[1].split('~'); resolve({ name: parts[1], current: parseFloat(parts[3]), change: parseFloat(parts[31]), changePercent: parseFloat(parts[32]), open: parseFloat(parts[5]), high: parseFloat(parts[33]), low: parseFloat(parts[34]), volume: parts[6], amount: parts[37] }); } else { reject(new Error('解析失败')); } } catch (e) { reject(e); } }); }).on('error', reject); }); } ``` ### Technical Analysis The HTTPS client buffers the complete response in the `data` string without imposing a maximum response size. It also does not configure a request timeout, abort stalled connections, validate the HTTP status code, or validate the response content type before parsing. A server that leaves the connection open can prevent the corresponding promise from settling. A server returning an excessively large response can cause substantial memory consumption because every chunk is appended to the in-memory string. Since the four index requests are made sequentially, one stalled request can block the entire scheduled report. HTTPS authenticates the configured hostname under the normal TLS trust model, but it does not protect the process from accidental upstream failures, a compromi ...[truncated 1067 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file-level comment says the script gets opening data, fund flow, sector performance, and sends a Feishu message. However, instead of only fetching market data, it invokes a local Python script in another skill workspace via execSync, which adds cross-skill command execution capability beyond what the documentation describes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documented purpose is to produce an A-share morning summary and send it to Feishu. Calling execSync to change directories and run an external Python search script is a broader capability than simple data collection/report generation and is not disclosed in the code documentation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script constructs a shell command containing message content and passes it to execSync, creating a command-injection surface if the generated report ever contains shell-significant characters not safely escaped. Because report text includes content influenced by external data sources, an attacker controlling or poisoning those sources could potentially break out of the quoted argument and execute arbitrary local commands.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: When run with --send, the script transmits generated content to Feishu, including text partially derived from external search results, without an explicit confirmation step or clear disclosure at send time. In an agent-skill context, silent external transmission can leak internal context, unexpected content, or manipulated third-party data to an external messaging channel.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file states that the skill sends a daily opening-market summary via Feishu and requires a Feishu webhook, but it does not include any user-facing warning about external transmission of generated content. For markdown files, outbound data-sharing behavior that may affect privacy or system integrity should be explicitly disclosed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill explicitly sends generated market summaries through a Feishu channel, but the documentation does not clearly disclose the outbound transmission behavior or precisely describe what data may leave the local environment. While the described content appears limited to market data, lack of disclosure can lead users to unknowingly enable external messaging and creates a transparency/privacy risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script description and user-facing output are written specifically for Chinese usage, and multiple date/time formatting calls hard-code the zh-CN locale. The file does not offer an opt-in or configuration for language/locale selection, which is a natural-language policy concern under the stated rules.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/morning-summary.mjs:86