mx-financial-assistant

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:34 AM UTC
• Version: 1.0.2

Overview

This financial Q&A skill is purpose-aligned, but its broad activation wording can route ordinary questions to an external Eastmoney API using a local API key.

Review before installing if you may ask non-financial or sensitive questions in Chinese, because broad trigger phrases could invoke the skill and send your question to Eastmoney's API. Avoid including account numbers, private portfolio details, or confidential trading plans unless you are comfortable sharing them with that provider, and prefer a version that narrows activation criteria and pins dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unpinned Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22-29
Vulnerability Type: Unpinned Python dependency
Risk Level: Medium

Vulnerable Code

json

"install": [
  {
    "id": "pip-deps",
    "kind": "python",
    "package": "httpx",
    "label": "Install Python dependencies"
  }
]

Technical Analysis

The installation configuration requests the httpx package without specifying an exact version or an integrity hash. Consequently, installations performed at different times can resolve to different package versions.

Although httpx is the expected dependency imported by scripts/generate_answer.py and no suspicious package source is configured, the absence of version and integrity constraints creates a supply-chain exposure. A compromised, malicious, or unexpectedly incompatible future release could be selected automatically during installation. Python packages may execute code during installation or later when imported, so compromise of the resolved dependency could lead to arbitrary code execution.

There is no evidence in the reviewed project that the dependency is currently malicious. The risk arises from unconstrained future dependency resolution.

Attack Path

1. An attacker compromises the package publisher account, distribution channel, or a future release of the dependency.
2. The attacker publishes a malicious version under the legitimate package name.
3. A user installs the Skill after that version becomes eligible for dependency resolution.
4. The installer resolves and downloads the malicious version because no exact version or integrity hash is required.
5. Attacker-controlled code executes during package installation or when httpx is imported by the Skill.
6. The code runs with the permissions of the installation or Skill runtime account.

Impact Assessment

Successful exploitation could permit arbitrary code execution within the security context of the user installing or running the Skill. Depending ...[truncated 444 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin httpx to an exact, reviewed version rather than allowing unconstrained resolution.
2. Maintain dependencies in a lock file generated by a trusted package-management workflow.
3. Require cryptographic hashes for downloaded distributions, such as with pip's --require-hashes option and a hash-locked requirements file.
4. Install packages only from a trusted, explicitly configured package index.
5. Perform dependency vulnerability and provenance scanning in CI before publishing the Skill.
6. Review and deliberately update the pinned version on a controlled schedule rather than accepting new releases automatically.
7. Run installation and execution in a least-privileged, isolated environment to reduce the impact of a compromised dependency.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The activation guidance includes very broad phrases such as '请问', '解释一下', and '总结一下', which overlap with common conversational language and can cause accidental invocation. In a skill that sends user questions to an external financial service, overbroad triggering can unintentionally route unrelated or sensitive user content off-platform.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes code that uses environment secrets and outbound network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens platform-level least-privilege controls and increases the chance that the skill can access or transmit data beyond what users or reviewers expect, especially because user queries are sent to an external financial API.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documentation describes taking the user's natural-language question and sending it to an external financial question-answering service, but it does not warn users that their query content leaves the local system. This creates a privacy and consent risk because users may include portfolio details, trading intentions, or other sensitive financial information without realizing it will be transmitted externally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The language requirement states the skill must always use Chinese and explicitly says that even if the user uses another language, the answer should still be generated in Chinese. This is a natural-language policy issue because it imposes a specific language without offering the user a choice or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The natural-language description, tool name, argument help text, and user-facing messages are all fixed in Chinese. This imposes a specific language/locale on users without any opt-in, language selection mechanism, or documented justification that the skill is intended only for a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends the user's raw financial question to a third-party remote API, but the code provides no user-facing disclosure, consent flow, or data-minimization step before transmission. Because financial queries can contain sensitive investment intent, portfolio details, or personally identifying context, silent transmission creates a real privacy and compliance risk even though HTTPS is used.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.