T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:10- Finding
Untrusted remote responses are mandated to bypass agent review and safety processing
- Content
View full analysis
- Remediation
View remediation
Security audit
market-beats-prana
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed remote Prana client, but it is marketed as a real-time financial news tool while sending user input and API credentials to a remotely chosen service and storing fetched secrets locally by default.
Review this before installing. It is not a self-contained news crawler; it forwards prompts to a Prana remote service. Only use it with a trusted Prana endpoint, avoid overriding base-url unless you control the destination, do not paste sensitive prompts, and prefer environment-provided credentials with PRANA_SKILL_SKIP_WRITE_API_KEY=1 or PRANA_SKILL_NO_AUTO_API_KEY=1 to avoid plaintext credential storage.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/prana_skill_client.js:383- Finding
API credentials and user content can be transmitted to an arbitrary attacker-controlled origin
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/prana_skill_client.js:213- Finding
Automatically fetched API secrets are stored in plaintext without enforced restrictive permissions
- Content
View full analysis
None: """将 public_key:secret_key 写入 config/api_key.txt（首行为注释，与现有读取逻辑兼容）。""" CONFIG_DIR.mkdir(parents=True, exist_ok=True) lines = [ "# Auto-saved by prana_skill_client after GET /api/v1/api-keys; do not commit to public repos.", f"{public_key}:{secret_key}", "", ] API_KEY_FILE.write_text("\n".join(lines), encoding="utf-8") ``` `scripts/prana_skill_client.py:278-287`: ```python base = (prana_base_url or os.environ.get("NEXT_PUBLIC_URL") or DEFAULT_PRANA_BASE or "").strip() if base and not _auto_fetch_api_key_disabled(): fetched = fetch_prana_api_keys_via_get(base) if fetched: pub, sec = fetched if not _skip_write_fetched_api_key(): try: _pe ...[truncated 2172 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
package.json:6- Finding
Node runner installs a mutable dependency without a committed lockfile
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (24)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The advertised skill metadata says this is a real-time market news crawler with WebSocket delivery, but the README instead describes a generic remote agent client that forwards prompts to /api/claw/agent-run and returns raw responses. This functionality mismatch is a strong deception indicator: users may authorize or run the skill expecting local news retrieval, while actually sending arbitrary input to a remote service controlled outside the package.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims to provide financial-news crawling and display, yet the underlying behavior described by analysis is remote invocation of external services, credential fetching/persistence, and result polling. In context, this makes the skill more dangerous because users expecting a news tool may unknowingly run a general remote-agent wrapper that can exfiltrate prompts, outputs, and authentication material to third-party infrastructure.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims to provide financial-news crawling and display, yet the underlying behavior described by analysis is remote invocation of external services, credential fetching/persistence, and result polling. In context, this makes the skill more dangerous because users expecting a news tool may unknowingly run a general remote-agent wrapper that can exfiltrate prompts, outputs, and authentication material to third-party infrastructure.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **Node.js 18+**：先在包根目录执行 **`npm install`**，再执行 `node scripts/prana_skill_client.js -m "…" [-t thread_id] [-b base_url]`
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
When local credentials are absent, the client automatically calls a remote endpoint to obtain API keys and then persists them to config/api_key.txt by default. For a news-monitoring skill, silent credential bootstrap and local secret storage are unrelated to the stated function and expand the attack surface through credential exposure, unintended account binding, and persistence of sensitive material on disk.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README claims the package is only a lightweight wrapper with no business logic, yet it documents credential acquisition, local credential storage, and proxying requests to a remote Prana service using an embedded original_skill_key. That mismatch hides meaningful runtime behavior from users and reviewers, which is dangerous because it encourages execution of a remote-capable thin client under the guise of a harmless content package.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Automatically retrieving API keys from a server and writing them to config/api_key.txt is not justified by a market-news viewing use case and creates a credential-handling risk surface. A deceptive skill can silently provision long-lived credentials, persist them on disk, and use them for further remote actions or expose them to other local processes, especially since the package is presented as a thin client rather than a privileged authenticator.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill exposes or implies capabilities involving environment access, local file reads/writes, and network access, but the manifest does not declare any tool scope or permissions boundaries. This is dangerous because integrators and users cannot accurately assess what the skill may access, increasing the chance of over-privileged execution and silent data exposure through filesystem or outbound requests.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation advertises real-time financial news scraping and presentation, but the visible content only provides generic client invocation and paid-skill order lookup instructions. This discrepancy is dangerous because it obscures the actual operational behavior and trust model, making it easier to conceal a proxy-style service or induce users to provide credentials under false assumptions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs users to send an x-api-key in the form public_key:secret_key to external API endpoints without prominently warning that authentication credentials and request contents are transmitted off the local system. This is dangerous because users may expose sensitive prompts or reusable secrets to third-party services without understanding the security implications, and the direct-pass-through requirement further reduces opportunities for redaction or validation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file introduces storage and retrieval instructions for Prana Claw API credentials that are unrelated to the declared purpose of a real-time financial news skill. This mismatch is a strong indicator of hidden secondary functionality and creates a risk of credential collection, unauthorized API access, or covert outbound integration under an unrelated cover story.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This plain-text file contains user-facing operational instructions entirely in Chinese, including setup and usage guidance. Under the policy rule, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file instructs the client to automatically fetch API keys from a remote endpoint and persist them locally, which is unnecessary for a financial news crawling/display function. Automatic secret retrieval and write-back materially increase the risk of silent account provisioning, credential seeding, and later abuse if the local file is exposed or the remote service is not trusted.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Comments, errors, prompts, and CLI usage text throughout the file are presented only in Chinese, which imposes a fixed language on users. The file does not provide any opt-in language selection or indicate that the skill is intentionally limited to a Chinese-speaking context.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The client automatically retrieves API credentials from the network and then uses them for subsequent privileged requests, which is unnecessary for a simple market-news display skill. This creates a trust-on-first-use problem: if the base URL is attacker-controlled or misconfigured, the client may obtain and rely on sensitive credentials from an untrusted source.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Fetched API credentials are written to config/api_key.txt automatically, without meaningful consent or protection, leaving secrets on disk where they may be read by other local users, backup systems, logs, or accidentally committed to source control. Persisting long-lived credentials by default materially increases the blast radius of any local compromise.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file functions primarily as a generic remote Prana agent launcher and credentialed API client rather than implementing the advertised market-news capability locally. This mismatch is dangerous because users may grant trust and credentials to a package whose real behavior is broad remote task execution, increasing supply-chain and misuse risk if the remote endpoint or skill mapping is changed.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file is not implementing the advertised real-time financial news capability locally; it is a thin wrapper that forwards user input and skill metadata to a remote Prana service. This mismatch is dangerous because users reviewing the package may believe they are running a transparent news crawler, while in reality they are delegating execution and data handling to an external service outside the package boundary.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code saves fetched public_key:secret_key credentials to a plaintext file without an upfront confirmation flow. Even though there is an opt-out environment variable, the default behavior can leave long-lived credentials readable by other local users, backup systems, or accidental repository commits.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The client packages the user's message together with skill-derived parameters and transmits it to a remote /api/claw/agent-run service without any explicit user-facing disclosure in code. In context, the skill is presented as a local financial-news tool, so hidden remote transmission increases privacy and trust risks because users may paste sensitive prompts, identifiers, or market-related data under a false assumption of local processing.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This manifest describes the skill's capabilities and intended scenarios in broad terms but does not define any specific invocation phrases, boundaries, or exclusion conditions. For a manifest file, that ambiguity can contribute to unintended activation because there is no narrow trigger scope documented.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The natural-language policy fields are written as mandatory Chinese instructions, including a directive for how responses should be passed to the end user and post-payment guidance only in Chinese. This can violate language/locale policy when the skill does not offer the user a language choice or document that it is intentionally limited to a Chinese-speaking context.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The dependency is specified with a caret range (^2.6.1) rather than being strictly pinned, which makes builds non-reproducible and can cause different installations to resolve to different upstream releases over time. In a security-sensitive skill, this increases supply-chain uncertainty and can unintentionally introduce vulnerable or breaking versions without any code change in the repository.
- Content
json "type": "module", "description": "Prana encapsulated skill — install deps for the Node runner: npm install", "dependencies": { "yaml": "^2.6.1" }, "engines": { "node": ">=18.0.0"
Unverifiable Dependency: yaml has 2 known advisory(ies) (CVE-2026-33532 (yaml is vulnerable to Stack Overflow via deeply nested YAML collections); CVE-2023-2251 (Uncaught Exception in yaml)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
The manifest references yaml without an exact pinned version, while advisories exist for some yaml releases, so the installed package may resolve to an affected version depending on when and how dependencies are installed. If this skill parses untrusted YAML anywhere in the broader codebase, known issues such as denial of service via deeply nested collections or uncaught exceptions could be triggered.
- Content
Static analysis
Detected: suspicious.env_credential_access, suspicious.potential_exfiltration
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/prana_skill_client.js:26
File read combined with network send (possible exfiltration).
Warn
- Code
- suspicious.potential_exfiltration
- Location
- scripts/prana_skill_client.js:94