T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:14- Finding
Unverified Remote Installer Is Piped Directly into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Stock Advisor Pro
Security checks for vulnerabilities and agentic risk
Overview
This A-share stock skill mostly matches its stated purpose, but its installer guidance, API handling, and bundled local data create avoidable security and privacy risks.
Review before installing. Do not run the README curl-to-shell installer unless you independently trust and verify it. Use a trusted uv installation path, pin dependencies, configure only a trusted HTTPS or loopback API endpoint, and assume stock symbols plus the API key go to that backend. Treat data/portfolio.json as plaintext local financial data and clear the bundled sample record before use.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/utils/api_client.py:5- Finding
API Credentials Can Be Sent to an Unrestricted or Plaintext Endpoint
- Content
View full analysis
dict: """Call cloud API for deep stock scan.""" response = requests.get(f"{self.base_url}/api/scan/{symbol}", headers=self.headers) response.raise_for_status() return response.json() def get_quote(self, symbol: str) -> dict: """Call cloud API for real-time quote.""" response = requests.get(f"{self.base_url}/api/quote/{symbol}", headers=self.headers) response.raise_for_status() return response.json() ``` The Skill manifest also explicitly presents plaintext HTTP as a supported endpoint: ```yaml - STOCK_ADVISOR_API_URL: "Stock Advisor Pro API address (for example: http://localhost:8000 or https://api.daas.ai)" ``` ### Technical Analysis The value of `STOCK_ADVISOR_API_URL` is accepted without validating its scheme, hostname, port, or trust level. Every API request attaches the configured API key in the `X-API-Key` header. Consequently, a configuration error or environment-variable manipulation can cause the credential to be transmitted to an attacker-controlled server. Plaintext `http://` is also accepted. While loopback HTTP can be appropriate for a local development service, the code does not enforce that HTTP destinations are actually loopback addresses. The ...[truncated 1576 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/scan.py:1- Finding
Runtime Dependencies Are Unpinned and Include an Unused Package
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
data/portfolio.json:1- Finding
Bundled Portfolio Data Exposes Financial and Workstation Metadata
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (15)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The explicit use of '| sh' creates a command chain that executes untrusted network content without review, magnifying the risk of supply-chain compromise and making exploitation trivial if the fetched content is altered. In a README, this is especially dangerous because users are likely to copy-paste it verbatim.
- Content
本插件建议使用
uv运行脚本，它会自动处理依赖：bash # 确保已安装 uv curl -LsSf https://astral.sh/uv/install.sh | sh2. 配置环境
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This finding captures the same core issue in English: the declared purpose suggests specialized investment-advisory functionality, while the implementation appears to perform generic local JSON persistence unrelated or only loosely related to the claimed analysis features. Such overclaiming can mislead users into invoking the skill in contexts involving sensitive financial data, with an inaccurate understanding of what the code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding captures the same core issue in English: the declared purpose suggests specialized investment-advisory functionality, while the implementation appears to perform generic local JSON persistence unrelated or only loosely related to the claimed analysis features. Such overclaiming can mislead users into invoking the skill in contexts involving sensitive financial data, with an inaccurate understanding of what the code actually does.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly states that portfolio data is stored locally and stock scans call a cloud backend, but it does not clearly warn users that sensitive financial data may persist on disk or be transmitted over the network. In an investment-related skill, this omission can mislead users about privacy boundaries and increase the risk of unintended disclosure of holdings or behavior.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises network, environment-variable, and local file capabilities through its documented commands and metadata, but it does not declare any explicit tool scope such as permissions or allowed-tools. That makes the effective privilege boundary opaque to users and reviewers, increasing the risk of over-broad execution and unintended access to secrets, filesystem data, or remote endpoints.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest description is entirely in Chinese and presents the skill as a Chinese-language experience without offering any language choice or stating that it is region- or language-specific by design. This can violate language/locale policy expectations when users are not given an explicit opt-in or alternative.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The invocation text for stock analysis is broad and phrased similarly to ordinary user requests, which can cause the skill to trigger in unintended contexts. Over-broad activation increases the chance that users' general financial questions are routed into code-executing workflows involving network calls or file access without sufficiently explicit intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description is written entirely in Chinese and frames the skill as a Chinese-language assistant without indicating that language selection depends on user preference. This can cause the agent to respond in an unintended language, undermining user intent and potentially reducing comprehension in a financial-advice context where misunderstanding can have downstream consequences.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script emits all user-facing status and portfolio messages in Chinese, while the CLI description is in English, with no option for the user to select a language or any documented reason for a Chinese-only interface. This is a natural-language locale policy concern because it imposes a specific language without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code emits multiple user-facing strings in Chinese, including the report title, section headers, and status messages, with no option for the user to select another language. That creates a language/locale policy issue because the skill forces a specific language without opt-in or documented regional scope.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Most of the user-facing description and usage guidance is written in Chinese, while the title and some labels are in English, and there is no indication that the skill is intentionally region-specific or that users can choose another language. This can violate a language/locale policy when a specific language is imposed without opt-in or justification.
- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The README instructs users to fetch and execute a remote installation script directly with curl piped into a shell. If the remote host, TLS trust chain, DNS, or delivery path is compromised, arbitrary code will execute immediately on the user's system with the user's privileges.
- Content
本插件建议使用
uv运行脚本，它会自动处理依赖：bash # 确保已安装 uv curl -LsSf https://astral.sh/uv/install.sh | sh2. 配置环境
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This manifest description states the skill's purpose but does not define when it should be invoked, what phrases should trigger it, or any exclusion conditions. In a manifest file, that lack of specificity can lead to overly broad or unintended activation if the platform uses description text for routing.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Line L16 stores
sys.prefix, which is the Python installation prefix, while the inline comment says it is a placeholder for timestamp logic. This is not merely incomplete documentation: the code records a filesystem/runtime path-like value in anadded_atfield whose comment indicates time metadata.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This code makes outbound HTTP requests to a cloud API and includes an X-API-Key header, which means user-supplied symbols and credentials are transmitted off-system. There is no confirmation prompt, visible user-facing log, or warning in this file indicating that data will be sent to an external service.
- Content