T09 · Insecure Skill Coding Practices
Error
- Location
scripts/timesfm_adapter.py:134- Finding
Caller-Controlled Values Are Embedded into Executable Python Source
- Content
View full analysis
- Remediation
View remediation
Security audit
AI Model Team
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent trading-prediction tool, but it has risky runtime and install behavior that users should review before installing.
Review before installing. Use an isolated virtual environment, do not run post_install.py until the package-rewrite approach is removed or justified, avoid passing untrusted symbol/timeframe values, pin Hugging Face models to reviewed revisions, and explicitly control any output path instead of allowing default writes into a personal Obsidian vault.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/post_install.py:80- Finding
Post-Install Script Rewrites an Installed Third-Party Package
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/kronos_adapter.py:35- Finding
Remote Model Artifacts Are Loaded Without Immutable Revision Pins
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Note
- Location
scripts/run_team.py:266- Finding
Orchestration Script Automatically Writes Outside the Project Directory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (122)
Known Vulnerable Dependency: transformers==4.57.6 — 9 advisory(ies): CVE-2026-4372 (HuggingFace transformers vulnerable to remote code execution); CVE-2026-1839 (HuggingFace Transformers allows for arbitrary code execution in the `Trainer` cl); CVE-2026-5241 (huggingface/transformers: Arbitrary Code Execution During Model Initialization i) +6 more
Critical
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
Pinning transformers==4.57.6 is highly dangerous if it is affected by multiple RCE and arbitrary code execution advisories, because transformer ecosystems often load remote or serialized model assets and execute complex initialization paths. This skill explicitly uses model libraries for prediction and optional neural sentiment analysis, which increases the practical attack surface if any model loading, Trainer usage, or untrusted configuration is involved.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The finding says the code is focused on backtesting/validation rather than prediction generation and lacks the declared integrations and network behavior. Although this is less severe than overtly dangerous side effects, it is still a trust and transparency failure that can mask what code will actually inspect, produce, or store.
- Content
Known Vulnerable Dependency: click==8.3.2 — 1 advisory(ies): CVE-2026-7246 (Pallets Click, versions 8.3.2 and below, contain a command injection vulnerabili)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
If click==8.3.2 is affected by a command injection flaw, any CLI entry points built on top of it could become dangerous when attacker-controlled arguments, environment variables, or shell-like inputs are passed through unsafe code paths. This project includes a CLI-oriented dependency set, so the vulnerability is relevant even if no exploit path is visible from requirements.txt alone.
- Content
Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'
High
- Category
- Supply Chain
- Confidence
- 70% confidence
- Finding
Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
- Content
Static analysis
No suspicious patterns detected.