Initiation of Coverage Agent

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:14 AM UTC
• Version: 1.0.4

Overview

The skill appears purpose-built for generating stock research reports, but it uses an API key and sends the user's original query to an external service with some under-scoped and unsafe credential-handling details users should review.

Review this skill before installing. It will use an EM_API_KEY, send your original prompt to Eastmoney's report-generation API, and save generated report files locally. Avoid using it for prompts containing confidential information, and prefer a version that disables unsafe redirects, pins dependencies, and clearly scopes network, environment-variable, and file-write permissions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_deep_research_report.py:111

Finding

API Credential Exposure Through Unrestricted Redirect Following

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_deep_research_report.py, lines 111-119
Vulnerability Type: Credential disclosure through unsafe redirect handling
Risk Level: Medium

python

async with httpx.AsyncClient(timeout=REPORT_TIMEOUT, follow_redirects=True) as client:
    resp = await client.post(
        FIRST_COVERAGE_URL,
        json={"query": query},
        headers={
            "Content-Type": "application/json",
            "em_api_key": EM_API_KEY,
        },
    )
    resp.raise_for_status()

Technical Analysis

The HTTP client automatically follows redirects while the request contains the sensitive EM_API_KEY value in the custom em_api_key header. Custom authentication headers do not necessarily receive the same cross-origin stripping protections as standardized authorization headers.

If the fixed Eastmoney endpoint is compromised or misconfigured to return a redirect to another origin, the client may propagate the custom header to the redirected destination. The user-provided query may also be transmitted to that destination, depending on the redirect status and resulting request behavior.

The initial endpoint uses HTTPS and is statically configured, which limits exploitation to circumstances where the service, its infrastructure, or its redirect behavior can be influenced. Nevertheless, unrestricted redirect handling creates an avoidable credential-disclosure boundary.

Attack Path

1. An attacker compromises the configured API service, an upstream component, or otherwise gains influence over its HTTP redirect response.
2. The endpoint returns a redirect to an attacker-controlled HTTPS origin.
3. Because follow_redirects=True, the client automatically follows the redirect.
4. The custom em_api_key header may be propagated to the redirected destination.
5. The attacker captures the API credential and potentially the user's research query.
6. The ...[truncated 525 chars]

Remediation

View remediation

Remediation Suggestions

• Disable automatic redirect following by setting follow_redirects=False.
• If redirects are operationally required, process each redirect manually and require:
  • The https scheme.
  • An exact hostname and port allowlist.
  • No HTTPS-to-HTTP downgrade.
  • A bounded number of redirects.
• Never forward em_api_key to a destination whose origin differs from the configured API origin.
• Reconstruct redirected requests explicitly rather than reusing credential-bearing headers.
• Consider using a standardized authorization mechanism if supported by the service.
• Add tests that simulate same-origin and cross-origin redirects and verify that credentials are never sent to an unapproved origin.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:14

Finding

Unpinned Third-Party HTTP Client Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-19 and line 58
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Low

json

"install": [
  {
    "id": "pip-deps",
    "kind": "python",
    "package": "httpx",
    "label": "Install Python dependencies"
  }
]

bash

pip3 install httpx --user

Technical Analysis

The Skill declares and instructs installation of httpx without a fixed version or integrity hash. Consequently, the installed dependency is selected from the package index at installation time rather than from a reproducible, reviewed dependency set.

No evidence indicates that the current httpx package is malicious. The security weakness is the absence of version and integrity controls: a future compromised release, unsafe release, or incompatible update could be installed automatically. Python package installation can execute package build logic, while imported package code executes with the privileges of the user running the Skill.

Attack Path

1. An upstream package release or relevant dependency becomes compromised or introduces exploitable behavior.
2. A user installs the dependency using the documented unversioned command or automated Skill installation metadata.
3. The package resolver selects the affected version because no reviewed version is pinned.
4. Malicious build logic may execute during installation, or malicious runtime logic may execute when the script imports httpx.
5. The affected code runs with the privileges of the installing or invoking user.

Impact Assessment

In a successful supply-chain compromise, dependency code could access files, environment variables such as EM_API_KEY, network resources, and other data available to the current user. It could also modify user-writable files or execute additional processes. The attainable scope is limited by the operating-system privileges and sandbox res ...[truncated 62 chars]

Remediation

View remediation

Remediation Suggestions

• Pin httpx to a specifically reviewed version instead of installing the latest available release.
• Maintain a lock file that also pins all transitive dependencies.
• Use hash-verified installation, such as a requirements.txt file with exact versions and SHA-256 hashes installed through pip --require-hashes.
• Update the Skill installation metadata and documented command so they reference the same pinned dependency set.
• Perform dependency updates through a controlled review process with vulnerability and provenance checks.
• Prefer a trusted, explicitly configured package index and prevent fallback to untrusted package sources.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes a Python script, depends on an API key, performs network calls, and writes report attachments, but it does not declare any explicit tool scope or allowed-tools boundary. This weakens least-privilege controls and can allow broader-than-necessary execution or make reviewers and runtime policy engines unable to constrain file, network, and environment access appropriately.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger condition is intentionally broad enough to fire even on generic requests like 'write a research report on company X,' which increases the chance the skill activates when a user did not specifically request this workflow. That can cause unintended external API calls, data transmission, and file generation, especially because the skill forwards the user’s original query to a backend script.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states it will pass the user's original query into a script that performs entity recognition and report generation via external services, but it does not provide a user-facing disclosure about this data sharing. Users may unknowingly send sensitive prompts or company identifiers to third-party APIs, creating privacy, compliance, and consent risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.