Security audit

ticker-pipeline

Security checks for vulnerabilities and agentic risk

Overview

This stock-research skill is not malicious, but it needs review because it performs broad web-driven financial analysis, gives prescriptive trading guidance, and automatically writes reports using unsanitized ticker-derived filenames.

Install only if you are comfortable with the agent querying market and web services for ticker research and creating report files in your workspace. Treat outputs as informational research, not personalized trading instructions, and require confirmation plus safe filename handling before any report is written or any recommendation is acted on.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: agents/intel_news.md:8
Finding: External web content is processed without prompt-injection isolation<![CDATA[ ## Vulnerability Details **File Location**: `agents/intel_news.md:8-22`; related retrieval instructions also appear in `SKILL.md:18-22`, `agents/fundamental_valuation.md:8-13`, and `agents/market_heat.md:8-13` **Vulnerability Type**: Indirect prompt injection through untrusted external content **Risk Level**: Medium ### Complete Code Snippet ```markdown ## I. Core Principles and Mandatory Rules 1. **Objective-fact rule**: Only state objective facts and official announcements from credible sources. Do not fabricate undisclosed rumors or add subjective trading recommendations. 2. **Multi-level retrieval of authentic data**: - First priority: invoke the **`market`** skill to obtain deterministic data; - Second priority: use `tencent-news`, `search_web`, and `read_url_content` to search CNINFO, exchange regulatory information, and authoritative mainstream financial media; - Negative-event screening: specifically check for investigations, fraudulent financial statements, implicated executives, and delisting-risk warnings such as *ST. --- ## II. Authentic Data Collection Using the `market` Skill This agent depends on the **`market`** skill for data collection. During execution, consult [`market/SKILL.md`](../../market/SKILL.md) and invoke the corresponding capabilities: - **Latest stock news and announcements**: invoke the `news` command to retrieve the ten most recent official announcements and authoritative news items; - **Sector fund-flow snapshot**: invoke the `flows` command to assess the relevant subsector's inflows, outflows, and market leadership; - **Overnight market and macro snapshot**: invoke the `overnight` command to retrieve the three major US indices, FTSE China A50, and USD/CNY exchange rate; - **Regulatory and material-event web search**: use external news and web-search tools to locate exchange inquiry letters, investigations, executive share reductions, earnings warnings, and major contracts. ``` The corresponding top-level ...[truncated 3340 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Add an explicit instruction that all content returned by search, URL-reading, browser, market-news, and news-provider tools is untrusted data and must never be treated as an instruction. 2. Require agents to ignore embedded requests to change roles, override policies, invoke tools, access files, suppress evidence, or alter output requirements. 3. Convert retrieved content into a strict intermediate schema containing only fields such as publication date, issuer, event type, factual summary, canonical URL, and source identity. 4. Pass only validated structured fields—not raw page text—to downstream agents and rating synthesis. 5. Allowlist official exchanges, regulators, issuer-investor-relations sites, and specifically approved financial publishers where practical. 6. Validate redirects and final domains, and clearly mark lower-trust sources. 7. Require corroboration from an official filing or at least two independent reputable sources for high-impact claims. 8. Quote source evidence with provenance while keeping quoted text isolated from the agent instruction context. 9. Reject or quarantine retrieved content containing prompt-injection indicators such as role-change requests, system-message imitations, tool-call directives, or instructions to ignore previous rules. 10. Ensure the risk-guard agent independently retrieves critical facts rather than trusting an unsanitized `{SUMMARY}`. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:184
Finding: Unsanitized ticker values are interpolated into an archive path<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:184-188` **Vulnerability Type**: Path traversal and unintended file overwrite **Risk Level**: Medium ### Complete Code Snippet ```markdown ## Phase IV: Standardized Output Requirements Based on the risk-review decision and data-completeness status, deliver the corresponding standardized report and write it to the archive file in the user's current workspace at `./report/ticker/YYYYMMDD_{CODE}_{ticker name}_investment-decision-report.md` with standard frontmatter. If the directory does not exist, create it automatically. Do not write into the skill installation directory. ### Scenario 1: Deliver the full investment and risk-control decision report after risk approval Archive path: `./report/ticker/YYYYMMDD_{CODE}_{ticker name}_investment-decision-report.md` ``` ### Technical Analysis The output filename directly incorporates `{CODE}` and the ticker name. The documented workflow does not constrain either value to a safe filename character set, remove path separators, reject traversal sequences, or verify the canonical destination before writing. `CODE` originates from user input, while the ticker name may be derived from market or web data. If either value contains `/`, `\`, `..`, absolute-path syntax, control characters, or platform-specific path metacharacters, the resulting path may no longer remain under `./report/ticker/`. The instruction to avoid writing into the skill installation directory is only a policy statement. It does not provide a mechanical containment check and therefore does not prevent traversal into other locations available to the agent. ### Attack Path 1. A user supplies a crafted ticker code, or an external source provides a crafted ticker name. 2. The value includes traversal or path-separator content, for example a sequence conceptually equivalent to `../../notes/target`. 3. The pipeline interpolates the value into the documented archive pattern without sanitizatio ...[truncated 1170 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate `CODE` against a strict market-specific allowlist, such as ASCII letters, digits, periods, and hyphens, with a conservative maximum length. 2. Treat the ticker name as display data rather than a trusted path component. Replace all characters outside a safe filename set with underscores. 3. Explicitly reject `/`, `\`, `..`, null bytes, control characters, absolute paths, drive prefixes, and reserved platform filenames. 4. Build the destination using a trusted path-join operation with `./report/ticker/` as the fixed base directory. 5. Resolve or canonicalize both the base directory and final destination, then verify that the destination remains a descendant of the canonical base directory. 6. Refuse the write if containment validation fails. 7. Use safe file-creation semantics that avoid overwriting existing files, or require explicit confirmation before replacement. 8. Keep the ticker code and name in frontmatter or report contents if the sanitized filename cannot preserve them safely. 9. Add a deterministic example implementation or helper routine so agents do not improvise path validation. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The prompt explicitly broadens data acquisition beyond the declared `market`-only workflow by allowing `search_web` and `read_url_content` when fields are missing. In a financial decision pipeline, this weakens provenance guarantees and can introduce inconsistent, stale, or manipulated external data despite the skill description promising strict market-only retrieval with abort-on-missing behavior.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The instructions claim missing critical data must cause immediate termination, but the adjacent lines first direct the agent to fetch missing values from the open web. That contradiction creates policy ambiguity, making it more likely the agent proceeds with unvetted fallback data in a risk-sensitive investment workflow where deterministic blocking was expected.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger description is very broad and includes generic phrases like '多Agent分析' and '标的透视', which can cause the skill to activate in situations the user did not clearly intend. In an autonomous or tool-using agent environment, overbroad activation increases the chance of unnecessary data collection, multi-agent execution, and downstream side effects such as report generation or external lookups.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to automatically write an archival report into the user's workspace, including creating directories if needed, without requiring user awareness or consent at execution time. This creates an unauthorized side effect on the local workspace and can lead to unwanted file creation, clutter, overwriting risks, or persistence of sensitive analysis artifacts.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The skill explicitly directs the agent to use external web services (`search_web`/`tencent-news`) to fetch real-time market data, but it provides no user-facing disclosure or consent mechanism for network access. This can cause unannounced transmission of user-supplied ticker/date context to third-party services and may violate expected privacy or deployment boundaries, especially in restricted environments.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The template presents concrete portfolio sizing and an automatic-exit style instruction as prescriptive trading guidance without any visible risk disclosure, suitability warning, or clarification that this is informational analysis rather than executable financial advice. In an investment-research pipeline context, this increases the chance that users over-rely on the output or treat it as authoritative trading instruction, potentially causing financial harm or inappropriate automated downstream use.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The line instructs 'unconditional' stop-loss execution on trigger conditions, which frames the content as an automatic trading directive without warning about execution risk, slippage, gaps, or the possibility that market conditions may make such rules unsuitable. Because this skill is explicitly a multi-agent decision pipeline producing a final research report, the wording makes it more dangerous by encouraging blind or automated action from generated text.

Static analysis

No suspicious patterns detected.