T09 · Insecure Skill Coding Practices
Error
- Location
research_workflow.py:66- Finding
Path Traversal Enables Arbitrary Python File Modification or Relocation
- Content
View full analysis
- Remediation
View remediation
Security audit
Research Strategy
Security checks for vulnerabilities and agentic risk
Overview
This skill is an autonomous trading-strategy workflow that can repeatedly create, run, rewrite, and promote code with too little user control.
Only install this in a disposable or tightly sandboxed auto-trading workspace. Treat backtest reports as trusted inputs only if their producer is controlled, and add validation, backups, review gates, resource limits, and a manual approval step before running generated strategies or moving files into the formal strategy directory.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
research_workflow.py:132- Finding
Untrusted Report Content Is Persisted into Agent Memory
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
SKILL.md:137- Finding
Unbounded Autonomous Workflow Executes Generated Code Without Approval
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose says the skill performs a full research workflow and must use a specific search assistant, but the described behavior also includes autonomous source modification, file movement, and workflow triggering that are materially different and more sensitive than the summary suggests. This mismatch can mislead a user into approving a skill that changes trading code and operational state beyond the advertised scope.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs autonomous directory creation, file creation, and background execution of backtesting and workflow scripts without requiring user confirmation or presenting safety warnings. In a trading-code context, this can alter the repository and launch persistent processes unexpectedly, creating operational and integrity risks.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The sub-agent template directs repeated autonomous execution in a loop, including searching, implementing, running backtests, and continuing without confirmation. This creates an uncontrolled automation pattern that can repeatedly modify code, consume resources, and propagate errors without human review.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest requires use of market-intel-assistant, but the sub-agent template tells spawned agents to use web_search instead. This contradiction weakens policy control and can cause downstream agents to bypass intended tool restrictions or use less-governed data sources during an automated workflow.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script automatically rewrites strategy source files based only on backtest metrics, with no confirmation, backup, integrity checks, or review gate. In this skill context, code under TEST_DIR is trading logic, so blind text replacement can silently corrupt strategy behavior or operational safeguards and can be triggered by untrusted report content selecting a target strategy name.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill directs reading and writing project files, but the manifest does not declare any explicit tool scope or permissions boundaries. That makes the effective capabilities opaque to users and enforcement layers, increasing the risk of unintended file access or modification when the skill is invoked.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The skill mandates a specific tool choice ('must use market-intel-assistant') without user opt-in. While not inherently malicious, forced tooling can override user preferences or organizational policy and becomes more concerning here because the skill already drives autonomous workflow steps around code and trading research.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest describes a complete autonomous strategy research workflow with required use of market-intel-assistant for searching, plus search→implement→backtest→evaluate→decide→record→loop. The code and module docstring show this file only listens for completed backtest reports, evaluates them, makes a simple decision, moves/modifies files, records results, and logs a report; there is no search step, no use of market-intel-assistant, and no implementation/backtest execution logic.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring, usage guidance, and user-facing runtime messages are written in Chinese, which imposes a specific language on users. There is no indication that the skill is region-specific or that users can select their preferred language, so this is a natural-language locale policy concern.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python python3 research_workflow.py # 后台运行 nohup python3 research_workflow.py > logs/research_workflow.log & """ import os
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Automatically promoting a test strategy into the formal strategy directory without approval or validation weakens change-control and can move flawed or unsafe trading code into a production-like location. In an automated trading environment, this increases the risk of accidental deployment of unreviewed logic with financial consequences.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The top-level docstring presents the script as a main program for 'Research Strategy', which suggests end-to-end strategy research behavior consistent with the skill purpose. In practice, the functions only consume existing JSON reports and then evaluate, decide, mutate strategy files, move files, and record outcomes; the documented framing overstates what the code actually does.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The record_to_memory function persistently appends entries to MEMORY.md, which modifies user project data. While this behavior is part of the workflow, the file-writing side effect is not clearly disclosed in a user-facing warning beyond a brief feature list.
- Content