ETF投资助理

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:05 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its ETF-assistant purpose, but its calculator can run unintended shell commands from crafted inputs, so it should be reviewed before installation.

Review or patch the calculator before installing. At minimum, require strict numeric validation for amount and years, avoid evaluating user input in shell arithmetic or bc source, and keep Yahoo Finance network lookups visible to users.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: etf-assistant.sh:237

Finding

Command Injection Through Unvalidated DCA Calculator Inputs

Content

View full analysis

Remediation

View remediation

&2 return 1 fi if [[ ! "$years" =~ ^[1-9][0-9]*$ ]]; then echo "Invalid duration: enter a positive whole number of years." >&2 return 1 fi if (( years > 100 )); then echo "Invalid duration: maximum supported duration is 100 years." >&2 return 1 fi ``` After these checks, use the validated integer duration in Bash arithmetic: ```bash local months=$((10#$years * 12)) ``` The `10#` prefix forces base-10 interpretation. For maximum isolation, perform the complete calculation in a small Python program that parses arguments with `decimal.Decimal`, rejects invalid or non-finite values, and never evaluates user input as source code. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · etf-assistant.sh (reported line 195)May include surrounding context.

sh

echo ""
    
    # 获取两只ETF的行情
    local price1=$(curl -s "https://query1.finance.yahoo.com/v8/finance/chart/${code1}.SS" 2>/dev/null | python3 -c "
import json, sys
try:
    data = json.load(sys.stdin)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · etf-assistant.sh (reported line 204)May include surrounding context.

sh

except: print('N/A')
" 2>/dev/null)
    
    local price2=$(curl -s "https://query1.finance.yahoo.com/v8/finance/chart/${code2}.SS" 2>/dev/null | python3 -c "
import json, sys
try:
    data = json.load(sys.stdin)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill advertises executable shell-style commands in its usage examples, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates an implicit capability boundary problem: an agent or runtime may infer or permit shell execution without an explicit least-privilege declaration, increasing the chance of unintended command execution or abuse if future content becomes dynamic or user-influenced.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

User-facing help text, command descriptions, and outputs are all presented only in Chinese. Under the language/locale policy, forcing a specific language without offering a choice can be a natural-language policy violation unless the locale limitation is clearly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The price command sends the user-supplied ETF code to Yahoo Finance without telling the user that their query is being transmitted to a third-party service. While the data sent is limited and not highly sensitive in this skill's context, it is still an information disclosure/privacy issue because user activity leaves the local environment unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The compare command performs two outbound requests to Yahoo Finance for user-provided ETF symbols without warning the user that their inputs are sent to a third party. This is a real but low-severity privacy/transparency issue, especially if users assume the tool works purely locally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.