T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:70- Finding
API Keys Exposed Through Terminal Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Einstein Research — Market Theme Detector
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent market-theme analysis tool, but it needs review because its instructions can expose API keys and its dependencies and network credential handling are under-hardened.
Review before installing. Do not run the echo commands for API keys; use presence checks instead, and rotate any key that may have been printed into logs. Run the skill in an isolated environment with pinned dependencies, expect outbound requests to FINVIZ, FMP, yfinance/GitHub data sources, and treat generated reports as informational market analysis rather than financial advice.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/representative_stock_selector.py:353- Finding
FINVIZ Elite Credential Embedded in Request URL
- Content
View full analysis
list[dict]: """Fetch stocks via FINVIZ Elite CSV export.""" if requests is None: return [] self._rate_limit() self._source_states["elite"].total_queries += 1 ind_code = _industry_to_code(industry) cap_code = CAP_ELITE_MAP.get(self._min_cap, "cap_smallover") perf_code = "ta_perf2_4wdown" if is_bearish else "ta_perf2_4wup" filter_str = f"ind_{ind_code},{cap_code},sh_avgvol_o100,sh_price_o10,{perf_code}" url = ( f"https://elite.finviz.com/export.ashx" f"?v=151&f={filter_str}&ft=4&auth={self._finviz_elite_key}" ) try: resp = requests.get(url, timeout=15) ``` ### Technical Analysis The FINVIZ Elite key is interpolated directly into the request URL as the `auth` query parameter. Although HTTPS protects the request in transit from ordinary passive interception, complete URLs may still be retained by application diagnostics, HTTP client instrumentation, outbound proxies, observability systems, exception reports, or server access logs. This network request is relevant to the declared dynamic stock-selection functionality and therefore does not constitute unrelated exfiltration. The security issue is the credential transport and handling method, not the fact that FINVIZ is contacted. Using a `params` dictionary would improve request construction and make redaction easier, but the resulting HTTP request still contains a query credential. If FINVIZ supports an authorization header, header-based authentication should be preferred. ### Attack Path 1. The Skill is run with FINVIZ Elite mode and a valid Elite key. 2. Dynamic stock selection invokes `_fetch_finviz_elite`. 3. The key is inserted i ...[truncated 720 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:81- Finding
Unpinned and Inconsistent Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
\ --hash=sha256: numpy== \ --hash=sha256: pandas== \ --hash=sha256: yfinance== \ --hash=sha256: finvizfinance== \ --hash=sha256: PyYAML== \ --hash=sha256: ``` Install it with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` Additional controls: - Generate and review a lock file using a reproducible dependency-management tool. - Align `README.md`, `SKILL.md`, and test documentation with the same manifest. - Separate runtime and development/test dependencies. - Use automated vulnerability and dependency-integrity scanning. - Review transitive dependencies before upgrades. - Perform installations in an isolated virtual environment under a non-privileged account. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The code is narrowly focused on calculating momentum-based rankings for industries using fixed return windows (1W, 1M, 3M, 6M). While this could support part of a broader market analysis workflow, it does not itself detect 'themes,' analyze sector rotation dynamics, identify narratives, or perform lifecycle analysis as described. The bullish/bearish labels are simple sign checks on weighted returns and not substantive narrative analysis. Therefore the declared description overstates and materially misrepresents the implemented behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The code’s actual function is a low-level securities metrics scanner, not a market-theme analysis engine. It fetches quote and historical data for specified symbols and computes indicators like RSI, 52-week distance, P/E, and ETF volume ratios, with FMP/yfinance fallback logic and caching. There is no logic for discovering themes across sectors, classifying hot/cold themes, inferring bullish or bearish narratives, or performing lifecycle analysis of themes. While such metrics could theoretically support later thematic analysis, that higher-level behavior is not implemented in this code chunk. Additionally, the code relies on external financial data services, which is not reflected in the declared permissions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose describes a skill for detecting and analyzing trending market themes across sectors. However, the actual code chunk only configures Python import paths for tests via sys.path insertion. It does not analyze markets, sectors, themes, narratives, or lifecycle states, nor does it access market data or implement any user-facing theme detection logic. This is a materially different primary purpose, so the description does not accurately represent this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The code does not implement market-theme detection, sector trend analysis, thematic investing analysis, or bullish/bearish narrative lifecycle analysis. Instead, it is a unit/integration test suite for config-loading utilities related to a themes YAML file. While the config contents reference themes and ETFs, the behavior shown is purely about loading and validating configuration data, not analyzing current market conditions or trends. Therefore, the declared description does not accurately represent the actual code behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is about high-level thematic market analysis across sectors and narratives. The actual code does not implement or test trend/theme detection, sector rotation analysis, thematic investing classification, or bullish/bearish narrative lifecycle analysis. Instead, it focuses on low-level market data retrieval and security-level metric computation for stocks and ETFs, along with infrastructure concerns like API migration, caching, batching, retries, and backend fallback behavior. These are materially different capabilities and indicate a primary purpose mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description promises a skill for detecting and analyzing trending market themes across sectors and identifying thematic narratives with lifecycle analysis. The actual code chunk does not implement that behavior. Instead, it contains unit tests for functions that score and rank industries using weighted returns over 1-week, 1-month, 3-month, and 6-month periods, assign bullish/bearish direction based on weighted return, and return top/bottom industries. While industry ranking could be a supporting component of broader market-theme analysis, this chunk neither performs theme detection nor lifecycle/narrative analysis. Because the primary behavior shown is materially narrower and different from the declared purpose, this is a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description is about identifying and analyzing broad market themes across sectors. The supplied code does not analyze themes or sector rotation; instead, it tests a downstream component that selects representative stocks for an already-defined theme. Its primary behavior is stock parsing, scoring, deduplication, source fetching, and resilience logic around FINVIZ/FMP/ETF holdings. Those capabilities are materially different from trend/theme detection, so the description does not accurately represent this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear description-behavior mismatch. The declared purpose describes a market-analysis skill focused on identifying trending sectors and themes, but the actual code chunk only contains unit tests for date staleness logic. The tested behavior is operational/business-date validation, not financial theme detection or sector analysis. No market data access, theme extraction, sector classification, or narrative analysis appears in the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose describes market-theme analysis functionality for end users. However, the supplied code does not implement any market analysis, trend detection, sector analysis, lifecycle analysis, or related logic. It only configures the test environment by inserting a scripts directory into sys.path so test modules can import project scripts. This is a materially different purpose from the declared description, so it should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description focuses on high-level market-theme analysis across sectors and thematic narratives. However, the code shown does not implement or test theme detection, sector rotation analysis, thematic investing logic, or bullish/bearish lifecycle analysis. Instead, it is narrowly concerned with low-level data acquisition and merge behavior for stock/ETF metrics, including fallback from FMP to yfinance and stats bookkeeping. This is a materially different primary purpose, so the description does not accurately represent the code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a market-intelligence capability: identifying trending sectors/themes and analyzing bullish or bearish narratives. The actual code chunk does not implement or invoke any such analysis. Instead, it contains unit tests for a performance-processing utility that caps extreme performance values and preserves originals. This is a materially different primary purpose. While outlier capping could be a supporting preprocessing step somewhere in a financial pipeline, this chunk itself is specifically test code for normalization logic, not theme detection or market-trend analysis.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose is a high-level market analysis skill focused on identifying current themes and sector narratives. The actual code chunk does not implement or support that behavior directly; it is only a narrow unit test for checking whether lifecycle input data is sufficient based on None/non-None values. There is no logic related to market themes, sectors, trends, narratives, or lifecycle analysis of themes. This is a materially different primary purpose, so it should be flagged as a mismatch.
- Content
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python tokens: list[str] = [] for ind in industries: name = ind.get("name", "") for token in name.split(): cleaned = token.strip("(),") if cleaned and cleaned not in _STOP_WORDS: tokens.append(cleaned)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill declares no explicit tool scope or permissions, yet its instructions clearly require reading environment variables, accessing the network, and writing files. That mismatch weakens governance and makes it harder for a platform to constrain what the skill can do, especially when API keys and external data sources are involved.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Broad activation language can cause the skill to trigger in situations where the user did not intend to invoke it, increasing the chance of unnecessary network access, credential use, and file generation. In an automated agent environment, overbroad routing can become a security problem because powerful behaviors are invoked too easily.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Ambiguous implicit triggers further increase the chance of accidental invocation. Given this skill's ability to access external data, read env-based credentials, and write reports, imprecise routing makes the operational risk more significant than it would be for a purely static or read-only skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The instructions explicitly access API-key environment variables without warning about secret handling. In practice, this can normalize unsafe treatment of credentials, and combined with shell snippets it raises the risk of accidental disclosure through logs, command history, debugging output, or downstream script behavior.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs installation of packages and execution of a local Python script, expanding its operational footprint beyond passive analysis. In a skill context, asking an agent to run local code can introduce supply-chain risk, unsafe execution, or unintended side effects if the script or dependencies are altered or insufficiently reviewed.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest frames this as an analysis skill, but the workflow writes timestamped reports to disk. Unadvertised file output creates persistence and data-handling risks, especially if reports include sensitive prompts, API-derived data, or internal analysis artifacts that users do not expect to be stored.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This template produces rankings, bullish/bearish assessments, heat scores, lifecycle stages, and top movers that can reasonably be interpreted as actionable investment guidance. Because it lacks a clear disclaimer that the output is informational only and not financial advice, users may rely on it for trading decisions, increasing legal, compliance, and user-harm risk.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest frames the skill as detecting and analyzing trending market themes, which suggests analytical output generation but not persistent filesystem writes. This module explicitly creates directories and saves report artifacts to disk, adding a storage/output side effect beyond pure analysis.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest describes a market-theme detection and analysis skill, but the documented workflow explicitly instructs checking environment variables with shell commands for FINVIZ and FMP API keys. Reading environment state is a separate capability that is not part of the user-facing analytical purpose and is not declared in the manifest context.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code creates an output directory and writes both JSON and Markdown files, which is a file-system side effect covered by the missing-warning rule for code files. Although the function docstring describes saving reports, there is no confirmation prompt, logging/print statement, or stronger user-facing disclosure at the operation itself.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The manifest frames this skill as detecting and analyzing trending market themes, which is primarily an analytics capability. This file explicitly persists reports to a reports directory and later resolves and writes to a user-supplied output path, adding filesystem output behavior that is not reflected in the manifest description.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
Allowing a caller to supply an arbitrary output directory expands writes beyond a fixed reports location and can cause the process to create files in unintended filesystem paths. In an agent/runtime context, this becomes more dangerous because user-controlled arguments may be influenced indirectly, enabling unauthorized file placement, overwriting application data, or writing into sensitive mounted directories accessible to the skill.
- Content
Static analysis
No suspicious patterns detected.