Investoday

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:01 AM UTC
• Version: 1.0.0

Overview

This finance skill is coherent and disclosed, but users should be cautious because it depends on an unpinned external Python package.

Install only if you trust the investoday-api package source. Prefer a dedicated virtual environment and a pinned, reviewed package version; treat outputs as informational financial analysis, not investment advice.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:36

Finding

Unpinned Third-Party Python Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36-39
Vulnerability Type: Unpinned and unverified third-party dependency
Risk Level: Medium

Vulnerable Code:

markdown

## 安装
```bash
pip install investoday-api

text

### Technical Analysis
The installation command resolves and installs the latest available release of `investoday-api` without an exact version constraint, cryptographic hash verification, lockfile, or reference to reviewed source code. The effective code installed by users can therefore change after this Skill has been audited.

Python packages may execute code during installation or when imported and used. If the package publisher account, package distribution channel, or a future release is compromised, following this instruction could introduce attacker-controlled code. The repository contains no implementation that would permit independent review of the package's advertised behavior, required permissions, network activity, or handling of financial data.

### Attack Path
1. An attacker compromises the package publisher account, distribution process, or another component in the dependency chain.
2. The attacker publishes a malicious release under the same package name.
3. A user follows the documented `pip install investoday-api` instruction.
4. Because no version or hash is specified, pip resolves the attacker-controlled release.
5. Malicious installation hooks or subsequently imported package code execute with the privileges of the user or environment running pip.

### Impact Assessment
Successful exploitation could execute arbitrary code with the installing user's privileges. Depending on that user's permissions and environment, the malicious dependency could read or alter accessible files, obtain environment variables or application credentials, make unauthorized network requests, tamper with financial data, or compromise the associated Python environment. This finding doe
...[truncated 150 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to an exact, security-reviewed version, such as investoday-api==X.Y.Z.
• Generate and verify cryptographic hashes, and install through a locked requirements file using pip install --require-hashes -r requirements.txt.
• Document the authoritative package repository, publisher, and reviewed source revision.
• Commit a lockfile that fixes all transitive dependency versions and review it whenever dependencies are updated.
• Add automated vulnerability, provenance, and package-integrity checks to the release process.
• Publish the Skill's integration code so reviewers can verify package usage, permissions, network destinations, and data handling.
• Recommend installation in a dedicated, least-privileged virtual environment rather than a system-wide or privileged Python environment.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill’s description, headings, modules, and trigger phrases are entirely Chinese and present no indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrase set includes very broad market-chat language such as asking how the market is doing, which can cause the skill to activate in general financial conversation without clear user intent. In a finance skill, unintended invocation is risky because it may surface investment-oriented analysis or market commentary when the user did not explicitly request this tool, increasing the chance of overreach or inappropriate financial guidance.

Content

No source excerpt is available for this finding.