Emq

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:04 AM UTC
• Version: 0.1.1

Overview

The skill is coherent for EMQ CLI use, but it needs review because it guides credentialed portfolio and order operations without enough safety boundaries.

Review this skill before installing. Use a dedicated virtual environment or container, pin and verify the emq-cli package, avoid exposing EMQ credentials in shared shells or logs, and only run portfolio/order/raw commands against accounts or sandboxes where you are prepared for the resulting changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 14; reinforced by agents/openai.yaml, line 4
Vulnerability Type: Unpinned and unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippets:

SKILL.md, line 14:

bash

pip install emq-cli

agents/openai.yaml, line 4:

yaml

default_prompt: "Use emq-cli via direct 'emq ...' commands after pip installation. Verify auth first, then choose domain commands (market/portfolio/quota/raw), and include concrete command lines with required flags."

Technical Analysis

The skill instructs users or agents to install emq-cli without specifying an exact version, cryptographic hash, trusted package index, or other integrity constraint. Consequently, the package resolved at installation time can differ from the package that was reviewed when this skill was published.

This creates a supply-chain exposure if the package distribution account or registry is compromised, a malicious release is published, or package resolution is redirected to an untrusted index. Because Python packages can execute code during installation or when imported and invoked, a malicious package version could run with the privileges of the user executing pip.

The agent configuration reinforces installation as the expected workflow but does not require package provenance or integrity verification. The audit did not establish that the current emq-cli package is malicious; the confirmed issue is the unsafe, mutable dependency-installation practice.

Attack Path

1. An attacker compromises the package publisher, package registry, dependency-resolution path, or configured Python package index.
2. The attacker publishes or serves a malicious version of emq-cli.
3. A user or agent follows the skill and runs pip install emq-cli.
4. pip resolves the attacker-controlled release because no version or hash is constrained.
5. Malicious c ...[truncated 1049 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin emq-cli to a specific, reviewed version, for example:

   bash

   python -m pip install "emq-cli==<reviewed-version>"
   

2. Distribute a requirements or lock file containing cryptographic hashes and require hash verification:

   text

   emq-cli==<reviewed-version> --hash=sha256:<verified-hash>
   

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Explicitly identify the trusted package repository and prevent fallback to untrusted or dependency-confusion-prone indexes.

4. Verify the package publisher, release provenance, signatures or attestations, and dependency tree before updating the pinned version.

5. Test updates in an isolated environment before deployment.

6. Prefer installation in a dedicated virtual environment or restricted container with only the filesystem, network, and credential access required for EMQ operations.

7. Update agents/openai.yaml so the default prompt requires the pinned, integrity-verified installation procedure rather than generic installation through pip.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file documents setting EMQ_USER and EMQ_PASS and performing authentication, which involves sensitive credentials. Under the markdown-specific warning criterion, the skill should disclose privacy/security implications of credential handling, but no warning or caution is provided near these instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The recipe includes commands that create portfolios and place orders, including batch orders and raw order submission, without any warning that these actions can have real, irreversible financial effects. In a trading CLI skill, omission of safety context increases the chance that users copy-paste examples into a live environment, causing unintended trades or portfolio mutations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The file title is in English while major section headings and comments are in Chinese, which effectively imposes a language assumption on users without any opt-in or explanation. Under the policy rule, forcing a specific language or locale without user choice can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.