指数直通车指数信息查询

• Outcome: Review
• Latest audit: Oct 14, 2026 · 2:28 AM UTC
• Version: 1.0.7

Overview

This is a disclosed Chinese-language market index lookup skill that stores an API key locally and uses it only to call a whitelisted Index Hub data API.

Install only if you are comfortable giving this skill an Index Hub API key, storing that key in a local plaintext file protected by filesystem permissions, and allowing network calls to the provider's HTTPS API. Use --skip-api-verify if you do not want the installer to make the setup-time connectivity check.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (20)

Tainted flow: 'request' from os.environ.get (line 346, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/api_client.py (reported line 356)May include surrounding context.

python

"X-Caller-Type": getattr(config, "CALLER_TYPE", "external"),
        },
    )
    with urllib.request.urlopen(request, context=ssl.create_default_context(), timeout=timeout) as response:
        raw = response.read().decode("utf-8")
    return validate_result(json.loads(raw))

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill presents itself as a financial data lookup tool, yet it also describes installation into user directories, prompting for and persistently storing API keys, validating local configuration, and performing outbound network verification. These administrative and secret-handling operations materially expand the risk profile because they can lead to credential capture, persistence on disk, and unexpected modification of the local environment.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill presents itself as a financial data lookup tool, yet it also describes installation into user directories, prompting for and persistently storing API keys, validating local configuration, and performing outbound network verification. These administrative and secret-handling operations materially expand the risk profile because they can lead to credential capture, persistence on disk, and unexpected modification of the local environment.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill presents itself as a financial data lookup tool, yet it also describes installation into user directories, prompting for and persistently storing API keys, validating local configuration, and performing outbound network verification. These administrative and secret-handling operations materially expand the risk profile because they can lead to credential capture, persistence on disk, and unexpected modification of the local environment.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 142)May include surrounding context.

sh

stage 4 "安装功能"
if [[ "$DO_INSTALL" -eq 1 ]]; then
  rm -rf "${SKILLS_DIR:?}/${SKILL_NAME}"
  # -L turns symlinks into ordinary files. Installed skills are
  # therefore self-contained even when this script is run from the repository.
  cp -RL "$SCRIPT_DIR" "${SKILLS_DIR}/${SKILL_NAME}" || fail "复制 ${SKILL_NAME} 失败。" "检查 ${SKILLS_DIR} 权限。"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill explicitly instructs use of shell, file access, environment variables, and networked API calls, but it does not declare any tool scope or allowed-tools boundary. That creates an over-privileged execution surface where an agent may access local files, read secrets, or invoke shell/network actions without an explicit least-privilege contract, increasing the chance of credential exposure or unintended system interaction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The instruction says to convert '中文自然语言' index queries, which imposes a Chinese-language expectation. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified or optional.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documentation frames the module as the public configuration for 'Index Hub' and describes index-hub authentication sources. In code, the primary backend URL is an ETF API service and one fallback credential is explicitly ETF_API_KEY, which contradicts the index-specific framing rather than merely omitting detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and user-facing error guidance are written only in Chinese, including instructions for obtaining the API key. This imposes a specific language/locale without indicating user opt-in or offering an alternative, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest says this skill is for securities index information and explicitly distinguishes index queries from ETF product queries. However, the code points to an ETF API service base URL and accepts a legacy ETF_API_KEY, which suggests the implementation is backed by ETF-oriented infrastructure rather than an index-specific service. That creates a meaningful description-to-behavior mismatch at the skill-boundary level.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The runtime error shown to users contains only Chinese instructions and references a WeChat mini-program for API key acquisition. Because this is user-facing operational guidance, presenting it in a single locale without choice or explicit regional justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file appends a fixed Chinese disclaimer to every finalized answer, regardless of the user's preferred language or locale. This creates a natural-language locale constraint without any visible opt-in, fallback, or documented region-specific justification in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This shell script presents user-facing errors, prompts, stage labels, and completion messages in Chinese throughout the installation flow. That constitutes a locale/language constraint in natural-language behavior without any visible opt-in or alternative language path.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 154)May include surrounding context.

sh

fi

mkdir -p "$CREDENTIALS_DIR" || fail "无法创建凭据目录：$CREDENTIALS_DIR" "检查 HOME 目录权限。"
chmod 700 "$CREDENTIALS_DIR" || fail "无法收紧凭据目录权限。" "检查 $CREDENTIALS_DIR 的所有权。"
CREDENTIALS_TMP="$(mktemp "${CREDENTIALS_FILE}.tmp.XXXXXX")" || fail "无法创建临时凭据文件。" "检查 $CREDENTIALS_DIR 的写入权限。"
chmod 600 "$CREDENTIALS_TMP" || fail "无法设置临时凭据文件权限。" "检查文件系统权限。"
printf '%s\n' "$API_KEY" > "$CREDENTIALS_TMP" || fail "无法写入凭据文件。" "检查 $CREDENTIALS_DIR 的写入权限。"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 156)May include surrounding context.

sh

mkdir -p "$CREDENTIALS_DIR" || fail "无法创建凭据目录：$CREDENTIALS_DIR" "检查 HOME 目录权限。"
chmod 700 "$CREDENTIALS_DIR" || fail "无法收紧凭据目录权限。" "检查 $CREDENTIALS_DIR 的所有权。"
CREDENTIALS_TMP="$(mktemp "${CREDENTIALS_FILE}.tmp.XXXXXX")" || fail "无法创建临时凭据文件。" "检查 $CREDENTIALS_DIR 的写入权限。"
chmod 600 "$CREDENTIALS_TMP" || fail "无法设置临时凭据文件权限。" "检查文件系统权限。"
printf '%s\n' "$API_KEY" > "$CREDENTIALS_TMP" || fail "无法写入凭据文件。" "检查 $CREDENTIALS_DIR 的写入权限。"
mv "$CREDENTIALS_TMP" "$CREDENTIALS_FILE" || fail "无法保存凭据文件。" "检查 $CREDENTIALS_DIR 的写入权限。"
chmod 600 "$CREDENTIALS_FILE" || fail "无法收紧凭据文件权限。" "检查 $CREDENTIALS_FILE 的所有权。"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 159)May include surrounding context.

sh

mkdir -p "$CREDENTIALS_DIR" || fail "无法创建凭据目录：$CREDENTIALS_DIR" "检查 HOME 目录权限。"
chmod 700 "$CREDENTIALS_DIR" || fail "无法收紧凭据目录权限。" "检查 $CREDENTIALS_DIR 的所有权。"
CREDENTIALS_TMP="$(mktemp "${CREDENTIALS_FILE}.tmp.XXXXXX")" || fail "无法创建临时凭据文件。" "检查 $CREDENTIALS_DIR 的写入权限。"
chmod 600 "$CREDENTIALS_TMP" || fail "无法设置临时凭据文件权限。" "检查文件系统权限。"
printf '%s\n' "$API_KEY" > "$CREDENTIALS_TMP" || fail "无法写入凭据文件。" "检查 $CREDENTIALS_DIR 的写入权限。"
mv "$CREDENTIALS_TMP" "$CREDENTIALS_FILE" || fail "无法保存凭据文件。" "检查 $CREDENTIALS_DIR 的写入权限。"
chmod 600 "$CREDENTIALS_FILE" || fail "无法收紧凭据文件权限。" "检查 $CREDENTIALS_FILE 的所有权。"

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is explicitly scoped to index information, but the reference adds a stock-quote endpoint that enables retrieval of individual equity real-time data. This kind of undocumented capability expansion can bypass tool-routing, user-consent, or policy assumptions built around an index-only skill, causing the agent to access broader market data than intended.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This Python file contains user-facing natural-language strings such as error messages, argument descriptions, and docstrings in Chinese only. Because the skill does not offer a language choice or document a justified region-specific constraint, it appears to impose a specific language/locale policy on all users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

该安装文档从标题开始即完全以中文编写，且未说明这是面向特定中文用户群体的区域性/合规性要求，也未提供其他语言选项。根据语言/locale 策略，若技能默认强制特定语言而无用户选择或明确正当理由，可构成自然语言策略问题。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code reads an API key from a user credential file under ~/.config/index-hub/api_key, which is access to sensitive credentials. While the module docstring documents the lookup order, there is no user-facing warning, prompt, or runtime disclosure when credential material is read.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/api_client.py:76