aim-trade-news

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:23 AM UTC
• Version: 1.0.0

Overview

This trade-news skill appears to query the stated external news API, but its setup asks the assistant to collect an API bearer token in chat and save it as plaintext locally.

Review this skill before installing. Use it only if you are comfortable with the AEP bearer token being pasted into the assistant conversation and stored unencrypted in the skill directory. Prefer a platform secret store or environment variable, rotate the token if it was shared in chat, and install dependencies in an isolated environment with pinned versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:118

Finding

Bearer Token Collection Through Chat and Plaintext Filesystem Storage

Content

View full analysis

``` 4. 重跑 `python3 scripts/search_news.py --check-config` 确认 `configured: true`，再继续用户原请求 脚本内置的 `load_dotenv()` 自动读取 `.env`，环境变量优先于文件。更多约束（如跨 agent 禁止共享凭证）见 [references/aep-setup.md](references/aep-setup.md)。 ``` Supporting instructions from `references/aep-setup.md:20-36`: ```markdown ### Step 2 · 引导用户提供凭证 对用户说： > 使用外贸资讯查询需要 AEP 凭证。请到 https://tools.mentarc.cn/aim-skills/ 注册获取 AEP_AUTHORIZATION（Bearer token），然后把凭证粘到对话框里发给我，我会帮你配好。 **不要**让用户自己编辑文件或设置环境变量。 ### Step 3 · 持久化凭证 将凭证写入 skill 目录下的 `.env` 文件： ``` AEP_AUTHORIZATION=<用户提供的token> ``` 只需填写 token 值，脚本会自动补全 `Bearer` 前缀。 ``` ### Technical Analysis The Skill explicitly directs users to paste an authentication bearer token into the conversation and directs the Agent to persist that token in a plaintext `.env` file. This creates two independent exposure surfaces: 1. The credential can remain in conversation history, Agent traces, telemetry, or operational logs. 2. The plaintext file can be read through local account compromise, overly broad filesystem permissions, backups, diagnostic archives, or another process operating under the same user. The `.gitignore` entry for `.env` only reduces accidental Git commits. It does not encrypt the token, restrict filesystem access, remove it from chat records, or prevent bac ...[truncated 1585 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded Third-Party Dependency Prevents Reproducible Installation

Content

View full analysis

=2.28 ``` The package is installed as documented in `README.md:34-38`: ```markdown ### Python 依赖 ```bash pip install -r requirements.txt ``` ``` ### Technical Analysis The dependency declaration specifies only a minimum version. Consequently, separate installations can resolve to different future versions of `requests` and its transitive dependencies. Those later versions are outside the version set reviewed during this audit. The installation command also does not require package hashes. Package integrity therefore depends entirely on the configured package index, TLS validation, and the current package-resolution result. This is a supply-chain hardening weakness rather than evidence that the current `requests` package is malicious. An unbounded declaration increases exposure to future compromised releases, unexpected compatibility changes, or malicious packages supplied by an untrusted package index. ### Attack Path 1. A user follows the documented setup process and executes `pip install -r requirements.txt`. 2. The resolver selects the newest compatible `requests` version and its then-current transitive dependencies. 3. A future release or a package served by a compromised or attacker-controlled configured index contains malicious code. 4. The package is installed without comparison against a reviewed lock file or required cryptographic hashes. 5. Malicious package code may execute during installation or when the Skill imports and uses the dependency. This is a conditional supply-chain path. The audit found no evidence that the currently named `requests` dependency is malicious. ### Impact Assessment If a resolved package is compromised, code can execute with the privil ...[truncated 409 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 1)May include surrounding context.

text

.env
.aim-secret-key.local
__pycache__/
*.pyc

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 23)May include surrounding context.

3. 复制配置模板并填入密钥：

bash

cp .env.example .env

编辑 .env，将 token 填入：

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 103)May include surrounding context.

md

"""
aim-trade-news: 查询最新外贸资讯（AI 摘要版）
数据源：AEP Gateway trending_hub 服务
凭据：从 .env 或环境变量读取 AEP 配置
"""
import sys
import json

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/search_news.py (reported line 5)May include surrounding context.

python

"""
aim-trade-news: 查询最新外贸资讯（AI 摘要版）
数据源：AEP Gateway trending_hub 服务
凭据：从 .env 或环境变量读取 AEP 配置
"""
import sys
import json

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/search_news.py (reported line 23)May include surrounding context.

python

"""
aim-trade-news: 查询最新外贸资讯（AI 摘要版）
数据源：AEP Gateway trending_hub 服务
凭据：从 .env 或环境变量读取 AEP 配置
"""
import sys
import json

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/search_news.py (reported line 24)May include surrounding context.

python

def load_dotenv():
    """Load .env from skill root (parent of scripts/). Env vars take precedence."""
    env_path = os.path.join(os.path.dirname(os.path.dirname(__file__)), ".env")
    if os.path.isfile(env_path):
        with open(env_path, encoding="utf-8") as f:
            for line in f:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/search_news.py (reported line 71)May include surrounding context.

python

def load_dotenv():
    """Load .env from skill root (parent of scripts/). Env vars take precedence."""
    env_path = os.path.join(os.path.dirname(os.path.dirname(__file__)), ".env")
    if os.path.isfile(env_path):
        with open(env_path, encoding="utf-8") as f:
            for line in f:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill performs sensitive actions involving environment access and outbound network requests but does not declare any explicit tool scope or permissions boundary. This weakens least-privilege controls and makes it harder for a host agent platform to constrain execution, increasing the chance of unintended data access or network misuse if the skill or its dependencies are modified or behave unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to collect a bearer token directly from chat and write it into a local .env file, which creates a clear secret-handling risk. Tokens pasted into conversation history may be retained in logs, visible to other components, or mishandled by the agent, and persisting them to a local file expands the attack surface if filesystem isolation is weak or other skills/processes can read it.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The display name, description, and default prompt are entirely in Chinese, which implies the skill is designed to operate in a specific language without offering the user a language choice or documenting a justified region-specific constraint. The policy specifically calls for flagging language or locale restrictions when they are imposed without user opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to collect a user bearer token through chat and persist it in a local .env file. For a low-risk trade-news query skill, this creates unnecessary credential-handling behavior, expands the secret exposure surface, and can leak tokens through logs, workspace access, backups, or later tool misuse.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document creates a natural-language flow for soliciting a bearer token in conversation and then writing it to disk, which is a classic secret-collection pattern. Chat channels are often logged and broadly accessible, so requesting credentials this way materially raises the risk of token disclosure and subsequent unauthorized API use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions direct silent persistence of a user-supplied token into .env without any user-facing warning that the credential will be stored locally or explanation of retention and access risks. This undermines informed consent and increases the chance of mishandling sensitive secrets in a way users do not expect.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search_news.py (reported line 90)May include surrounding context.

python

}

    try:
        resp = requests.post(API_URL, json=payload, headers=headers, timeout=30)
    except requests.RequestException as e:
        return {
            "success": False,

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file states that the skill queries AEP Gateway's trending_hub service in real time, which is a network operation covered by the warning requirement for markdown files. While setup details for the token are provided, there is no explicit user-facing warning about external data transmission, privacy implications, or reliance on a third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language instructions and usage guidance are presented only in Chinese, which can amount to a language policy issue when no opt-in or alternative locale is offered. The README does not state that the skill is intentionally region-specific or limited to Chinese-speaking users.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency specifier requests>=2.28 is unpinned, so installations may resolve to different versions over time and across environments. This weakens reproducibility and makes it difficult to verify whether a deployed version includes known security fixes or unexpectedly introduces vulnerable behavior through supply-chain drift.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.28

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

Because requests is not pinned, the manifest does not establish whether the installed version includes fixes for known advisories affecting older releases. This creates uncertainty in the security posture and can allow vulnerable versions to be installed in some environments, especially where dependency resolution is not tightly controlled.

Content

No source excerpt is available for this finding.