指数直通车场外指数基金信息查询

• Outcome: Review
• Latest audit: Oct 14, 2026 · 3:32 AM UTC
• Version: 1.0.5

Overview

This skill is a disclosed Chinese-language fund data query tool that stores an API key locally and uses it only to call the documented Index Hub/ETF data service.

Install only if you intend to use the 易方达/指数直通车 data service and are comfortable storing its API key at ~/.config/index-hub/api_key. Review the installer options first, especially --skills-dir and --skip-api-verify, because installation replaces any existing open-fund-query skill folder at the target path and may call the remote service to verify the key.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (20)

Tainted flow: 'request' from os.environ.get (line 342, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/api_client.py (reported line 352)May include surrounding context.

python

"X-Caller-Type": getattr(config, "CALLER_TYPE", "external"),
        },
    )
    with urllib.request.urlopen(request, context=ssl.create_default_context(), timeout=timeout) as response:
        raw = response.read().decode("utf-8")
    return validate_result(json.loads(raw))

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill is presented as a simple query capability, but it also describes installation, local persistence of API keys, permission checks, and remote connectivity validation. Those extra operational behaviors are not necessarily malicious, but if undisclosed they expand the attack surface and can lead to unsafe handling of secrets or unexpected system modification during setup.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as a simple query capability, but it also describes installation, local persistence of API keys, permission checks, and remote connectivity validation. Those extra operational behaviors are not necessarily malicious, but if undisclosed they expand the attack surface and can lead to unsafe handling of secrets or unexpected system modification during setup.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a simple query capability, but it also describes installation, local persistence of API keys, permission checks, and remote connectivity validation. Those extra operational behaviors are not necessarily malicious, but if undisclosed they expand the attack surface and can lead to unsafe handling of secrets or unexpected system modification during setup.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 142)May include surrounding context.

sh

stage 4 "安装功能"
if [[ "$DO_INSTALL" -eq 1 ]]; then
  rm -rf "${SKILLS_DIR:?}/${SKILL_NAME}"
  # -L turns symlinks into ordinary files. Installed skills are
  # therefore self-contained even when this script is run from the repository.
  cp -RL "$SCRIPT_DIR" "${SKILLS_DIR}/${SKILL_NAME}" || fail "复制 ${SKILL_NAME} 失败。" "检查 ${SKILLS_DIR} 权限。"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill explicitly instructs use of network, shell, environment variables, and local file access, including reading API keys from environment variables and user config paths, but it does not declare any explicit tool scope or permissions boundary. That makes the runtime trust model ambiguous and increases the chance of over-broad tool access, credential exposure, or unintended execution paths if the agent platform grants default capabilities.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction states the skill converts requests from '中文自然语言', which imposes a Chinese-language requirement in the skill's natural-language behavior. The file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-only regulatory or regional context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

文件头文档声明这是“Index Hub v3.0.0 统一配置”，并描述读取 INDEX_HUB_API_KEY / ~/.config/index-hub/api_key，但实际目标服务常量是 etf.com.cn 的 etf-api-service，且还回退到 ETF_API_KEY。这不是单纯信息不全，而是文档所指向的产品/接口身份与实际代码依赖对象存在明显偏差，容易误导审核者对该技能真实后端用途的理解。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The module docstring and the runtime error message are presented exclusively in Chinese, including the instructions for obtaining an API key. Under the policy, forcing a specific language without offering a choice or documenting a justified locale constraint can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file defines a mandatory disclaimer entirely in Chinese and finalize_answer appends it to every customer-facing answer. This enforces a specific language/locale for all outputs without any visible user opt-in or documented region-specific justification in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This shell script presents operational errors, prompts, and progress messages in Chinese, including installation failures and API key input instructions. Because the file contains no natural-language indication that the skill is China/Chinese-only or that users can choose another language, it violates the locale-choice policy for natural-language content.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 154)May include surrounding context.

sh

fi

mkdir -p "$CREDENTIALS_DIR" || fail "无法创建凭据目录：$CREDENTIALS_DIR" "检查 HOME 目录权限。"
chmod 700 "$CREDENTIALS_DIR" || fail "无法收紧凭据目录权限。" "检查 $CREDENTIALS_DIR 的所有权。"
CREDENTIALS_TMP="$(mktemp "${CREDENTIALS_FILE}.tmp.XXXXXX")" || fail "无法创建临时凭据文件。" "检查 $CREDENTIALS_DIR 的写入权限。"
chmod 600 "$CREDENTIALS_TMP" || fail "无法设置临时凭据文件权限。" "检查文件系统权限。"
printf '%s\n' "$API_KEY" > "$CREDENTIALS_TMP" || fail "无法写入凭据文件。" "检查 $CREDENTIALS_DIR 的写入权限。"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 156)May include surrounding context.

sh

mkdir -p "$CREDENTIALS_DIR" || fail "无法创建凭据目录：$CREDENTIALS_DIR" "检查 HOME 目录权限。"
chmod 700 "$CREDENTIALS_DIR" || fail "无法收紧凭据目录权限。" "检查 $CREDENTIALS_DIR 的所有权。"
CREDENTIALS_TMP="$(mktemp "${CREDENTIALS_FILE}.tmp.XXXXXX")" || fail "无法创建临时凭据文件。" "检查 $CREDENTIALS_DIR 的写入权限。"
chmod 600 "$CREDENTIALS_TMP" || fail "无法设置临时凭据文件权限。" "检查文件系统权限。"
printf '%s\n' "$API_KEY" > "$CREDENTIALS_TMP" || fail "无法写入凭据文件。" "检查 $CREDENTIALS_DIR 的写入权限。"
mv "$CREDENTIALS_TMP" "$CREDENTIALS_FILE" || fail "无法保存凭据文件。" "检查 $CREDENTIALS_DIR 的写入权限。"
chmod 600 "$CREDENTIALS_FILE" || fail "无法收紧凭据文件权限。" "检查 $CREDENTIALS_FILE 的所有权。"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 159)May include surrounding context.

sh

mkdir -p "$CREDENTIALS_DIR" || fail "无法创建凭据目录：$CREDENTIALS_DIR" "检查 HOME 目录权限。"
chmod 700 "$CREDENTIALS_DIR" || fail "无法收紧凭据目录权限。" "检查 $CREDENTIALS_DIR 的所有权。"
CREDENTIALS_TMP="$(mktemp "${CREDENTIALS_FILE}.tmp.XXXXXX")" || fail "无法创建临时凭据文件。" "检查 $CREDENTIALS_DIR 的写入权限。"
chmod 600 "$CREDENTIALS_TMP" || fail "无法设置临时凭据文件权限。" "检查文件系统权限。"
printf '%s\n' "$API_KEY" > "$CREDENTIALS_TMP" || fail "无法写入凭据文件。" "检查 $CREDENTIALS_DIR 的写入权限。"
mv "$CREDENTIALS_TMP" "$CREDENTIALS_FILE" || fail "无法保存凭据文件。" "检查 $CREDENTIALS_DIR 的写入权限。"
chmod 600 "$CREDENTIALS_FILE" || fail "无法收紧凭据文件权限。" "检查 $CREDENTIALS_FILE 的所有权。"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The section titled '回答口径说明模板（输出必守）' mandates how answers must be written and all examples/instructions are exclusively in Chinese, implying a fixed output language. This is a natural-language policy concern because the file does not mention user opt-in, multilingual support, or a region-specific justification for enforcing Chinese.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The allowlist includes ETF and stock quote endpoints that exceed the declared off-market fund query scope of the skill. This scope expansion weakens least-privilege boundaries: if the skill or its caller is abused, it can access broader market data than users and reviewers would expect from the manifest.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code contains multiple natural-language strings presented to users in Chinese, such as runtime errors and command-line help, with no indication that the skill is China-specific or that users can choose a language. That creates a locale-policy concern because the skill effectively forces a specific language for interaction and failures.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

该技能的声明用途是查询场外指数基金信息；发起带认证的网络请求本身是合理实现细节，但额外从 ~/.config/index-hub/api_key 读取本机全局凭据属于扩展的本地敏感数据访问能力。清单描述并未说明需要读取本地凭据文件或复用其他产品的全局认证配置，因此这一能力与声明用途相比显得不够自洽。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code reads sensitive authentication material from both environment variables and a credentials file, which falls under sensitive environment variable or credential access. The file contains no user-facing print/log message, confirmation, or explanatory docstring/comment warning about this behavior; the existing comments only describe configuration format.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The top-level docstring presents this file as a generic 'client for the Index Hub API' with generic path whitelisting, while the skill manifest claims a narrowly scoped OEF information query capability. This indicates the implementation is intentionally broader infrastructure for a wider API surface than the manifested skill purpose.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/api_client.py:72