finoview-report

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:35 AM UTC
• Version: 1.0.1

Overview

The skill appears to be a legitimate Finoview report API helper, but its documentation tells users to print full API credentials, which creates a real secret-exposure risk.

Install only if you need Finoview futures report access and are comfortable configuring API credentials. Do not run the documentation's examples that print credential values; use presence-only checks instead, and rotate credentials if they may have been printed into logs, screenshots, or chat history.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:56

Finding

API Credentials Exposed by Documented Verification Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 56–59
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: Medium

Vulnerable Code Snippet:

python

import os
print("API Key:", os.environ.get("FINOVIEW_API_KEY", "未配置"))
print("API Secret:", os.environ.get("FINOVIEW_API_SECRET", "未配置"))

Technical Analysis

The documented credential-verification procedure prints the complete values of FINOVIEW_API_KEY and FINOVIEW_API_SECRET to standard output. Although the credentials are appropriately sourced from environment variables rather than hardcoded in the application, disclosing their full values defeats the confidentiality benefit of that storage mechanism.

Terminal output may be retained in scrollback buffers, CI/CD logs, remote-session recordings, support transcripts, screenshots, or agent conversation history. Any person or system able to access such output could recover both credentials.

Attack Path

1. A user configures valid Finoview API credentials as instructed.
2. The user runs the documented verification snippet.
3. The complete API key and secret are written to standard output.
4. The output is captured through terminal logging, session recording, CI logs, screenshots, or copied diagnostic output.
5. An unauthorized party obtains the captured output and extracts the credentials.
6. The party uses the credentials to authenticate to the Finoview API, subject to the permissions and restrictions assigned to that credential pair.

Impact Assessment

Successful exploitation exposes the Finoview API key and secret. An attacker could make authenticated API requests with the compromised account's privileges, consume applicable quotas, access API data available to that account, and cause requests to be attributed to the legitimate credential owner.

The impact is limited to the permissions granted to the compromised Finoview credentials; the reviewed code does n ...[truncated 122 chars]

Remediation

View remediation

Remediation Suggestions

Replace the verification example with a presence-only check that never prints credential values:

python

import os

key_configured = bool(os.environ.get("FINOVIEW_API_KEY"))
secret_configured = bool(os.environ.get("FINOVIEW_API_SECRET"))

print("API Key configured:", key_configured)
print("API Secret configured:", secret_configured)

Additional hardening measures:

1. Explicitly warn users never to print, log, screenshot, or paste complete credentials.
2. If identification is necessary, display only a short masked suffix and avoid revealing credential length.
3. Ensure application and CI logging systems redact both environment-variable values.
4. Rotate any credentials that may already have been exposed through this verification procedure.
5. Apply least-privilege permissions, usage quotas, expiration, and source restrictions to API credentials where supported.
6. Prefer a managed secret store for production deployments and audit access to stored credentials.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill explicitly instructs users to configure and read sensitive credentials from environment variables, but it does not declare any tool scope, permissions, or allowed-tools metadata describing that environment access is required. In an agent platform, this mismatch can lead to over-broad runtime access or make credential handling invisible to reviewers, increasing the chance of unintended secret exposure or unauthorized env access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description and the entire skill documentation are presented exclusively in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate a language/locale policy where user-facing skills should not force a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code file contains natural-language instructions and messages entirely in Chinese, including the module docstring and later runtime output, with no indication that the skill is region-specific or that users may opt into another language. That creates a language/locale policy concern because the skill implicitly requires Chinese comprehension rather than offering a choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.