T03 · Remote Payload Retrieval and Execution
Error
- Location
agent/AGENTS.md:21- Finding
Automatic Retrieval and Execution of an Unpinned Remote Installer
- Content
View full analysis
- Remediation
View remediation
Security audit
jun-invest-option-master-installer (DEPRECATED)
Security checks for vulnerabilities and agentic risk
Overview
This deprecated installer contains powerful update, install, and agent-registration workflows that can change local agent state without clear approval gates.
Review this package carefully before installing. It should not be used in an environment where an agent may run update/install commands automatically; require explicit approval for package updates, script execution, destination paths, and agent registration, and use only a local trusted Futu OpenD endpoint unless transport security is fixed.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T06 · System Persistence
Error
- Location
agent/AGENTS.md:21- Finding
Non-Interactive Registration of a Remotely Updated Agent Workspace
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/install.sh:49- Finding
Workspace Path Traversal and Destructive Destination Replacement
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
agent/invest_agent/integrations/futu/futu_adapter.py:32- Finding
Broker API Transport Encryption Explicitly Disabled for Configurable Hosts
- Content
View full analysis
None: self.host = host self.port = int(port) self.market = (market or "US").upper() self._quote_ctx = None def _ensure_ctx(self) -> None: if self._quote_ctx is not None: return if OpenQuoteContext is None: raise RuntimeError( "futu-api is not installed. Install with: pip install futu-api" ) from _FUTU_IMPORT_ERROR try: self._quote_ctx = OpenQuoteContext(host=self.host, port=self.port, is_encrypt=False) except TypeError: self._quote_ctx = OpenQuoteContext(host=self.host, port=self.port) ``` The host is configurable in `agent/invest_agent/integrations/futu/futu_adapter.py:382-389`: ```python def load_from_env() -> "FutuAdapter": host = os.getenv("FUTU_OPEND_HOST", "127.0.0.1") port = int(os.getenv("FUTU_OPEND_PORT", "11111")) market = os.getenv("FUTU_MARKET", "US") return FutuAdapter(host=host, port=port, market=market) ``` ### Technical Analysis The adapter explicitly passes `is_encrypt=False` while allowing the OpenD host to be supplied through an environment variable. The default loopback host reduces exposure in the default configuration, but the associated documentation anticipates both local and remote gateway locations. When a non-loopback endpoint is configured, quote requests, requested ticker and option symbols, health information, and returned broker market data may cross an untrusted network without application-level transport encryption. A fallback constructor is also used without confirming whether encryption is enabled by default. The reviewed adapter uses `OpenQuoteContext` and conta ...[truncated 1352 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (52)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A package presented as deprecated but capable of installing files, creating backups, modifying directories, and invoking external tooling is highly dangerous because it can change the local environment while evading scrutiny. In this context, concealed installer behavior materially increases the risk of unauthorized filesystem modification and supply-chain style abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A package presented as deprecated but capable of installing files, creating backups, modifying directories, and invoking external tooling is highly dangerous because it can change the local environment while evading scrutiny. In this context, concealed installer behavior materially increases the risk of unauthorized filesystem modification and supply-chain style abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A package presented as deprecated but capable of installing files, creating backups, modifying directories, and invoking external tooling is highly dangerous because it can change the local environment while evading scrutiny. In this context, concealed installer behavior materially increases the risk of unauthorized filesystem modification and supply-chain style abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A package presented as deprecated but capable of installing files, creating backups, modifying directories, and invoking external tooling is highly dangerous because it can change the local environment while evading scrutiny. In this context, concealed installer behavior materially increases the risk of unauthorized filesystem modification and supply-chain style abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A package presented as deprecated but capable of installing files, creating backups, modifying directories, and invoking external tooling is highly dangerous because it can change the local environment while evading scrutiny. In this context, concealed installer behavior materially increases the risk of unauthorized filesystem modification and supply-chain style abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A package presented as deprecated but capable of installing files, creating backups, modifying directories, and invoking external tooling is highly dangerous because it can change the local environment while evading scrutiny. In this context, concealed installer behavior materially increases the risk of unauthorized filesystem modification and supply-chain style abuse.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The default workflow states that a feature request should lead to repository modification, git commit, publishing a new installer version, and automatic deployment, without warning the user that this is a release-and-deploy pipeline. That creates a serious integrity and supply-chain risk because ordinary conversational requests can be escalated into persistent code changes and distribution events.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest says the skill is a deprecated installer and points users to another agent, but this code reads multiple investment-analysis JSON artifacts, fills an approval packet template, and writes a completed markdown report. That behavior is semantically unrelated to an installer and indicates the implemented functionality diverges from the skill's declared purpose.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The visible user-facing instructions are entirely in Chinese ('此 skill 已废弃。请改用...') with no alternative language or opt-in, which can violate language/locale policy requirements. Nothing in the file indicates that the skill is region-specific or that the user can choose the language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The operational instructions and trigger phrases are defined entirely in Chinese, and the file does not indicate that users may choose another language or that the locale is intentionally restricted for a documented regional purpose. This can constitute a language/locale policy issue when a skill effectively forces one language without opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger phrases are broad and designed to cause automatic execution from short natural-language prompts, with only a limited exclusion about not upgrading the OpenClaw core. This increases the chance of ambiguous or accidental activation of privileged update actions, especially when the commands include forceful update behavior.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documented behavior goes well beyond a passive deprecated reference: it performs forced package updates, runs an installer script, modifies a local workspace, and registers an agent. In a deprecated installer, this creates hidden operational authority and can mislead users into invoking impactful system changes under a narrow or outdated description.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instructions direct the agent to perform local system modifications automatically, including forced updates, running a shell installer, synchronizing files into a user workspace, and registering the agent, without an explicit warning or consent checkpoint. This is dangerous because it normalizes silent execution of privileged and state-changing operations from a conversational trigger.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill includes a default workflow to modify code, commit it, publish a new installer version, and immediately deploy it, which materially expands its authority beyond a simple installer. That creates a supply-chain risk: a user request framed as a feature change could trigger code publication and propagation without a separate approval boundary.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The entire skill documentation is presented in Chinese and names a specific approver (
生哥) without indicating that language is configurable or optional. Under the policy criteria, forcing a specific language or locale without user opt-in can constitute a natural-language policy violation.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The instruction specifies the skill's style in Chinese and directs a fixed communication mode without indicating that users may choose another language or locale. This can violate language/locale policy when the skill is used in broader contexts where user language preference is not explicitly collected.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This manifest file contains a natural-language note in Chinese at L13, while the rest of the file is in English. That creates a language/locale policy concern because the skill content implicitly forces a specific language for part of the policy without user opt-in or an explicit region-specific justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file presents the skill plan and operating instructions entirely in Chinese, beginning with the title and continuing through most procedural content. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The title and stated goal are written as fixed Chinese instructions, and the file does not indicate that language is selectable by the user. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README is written entirely in Chinese and includes user-facing trigger and usage instructions only in Chinese, with no indication that another language is supported or that Chinese is a justified locale constraint. Under the policy rule for language/locale, this is a natural-language policy concern because the skill effectively imposes a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The note at L13 is written in Chinese while the rest of the policy file is in English-like identifiers, which can impose a specific language on readers or operators without opt-in. The stated policy requires flagging language or locale constraints when no user choice or justification is provided.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The top-level documentation explicitly limits the adapter to quotes and health checks, and notes no order placement. However, the class implements get_options_chain_summary, which fetches option chains, market snapshots for options, and computes derivatives analytics like ATM IV and put skew. This is an active contradiction in documented scope, not merely missing detail.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file-level description states the adapter is for "quotes + healthcheck only," which implies a narrow market-data role. The implemented get_options_chain_summary method goes beyond that by accessing option contract chains and computing analytics such as ATM implied volatility, bid/ask spread summaries, and put skew. That behavior exceeds the stated scope.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
When broker spot data is unavailable, the adapter silently falls back to a public yfinance integration, introducing an undocumented external network dependency and data-source change. In security-sensitive or regulated environments, this can bypass expected egress restrictions, leak user interest in specific tickers to a third party, and violate trust assumptions that this adapter is Futu-only.
- Content