T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:20- Finding
Mandatory Response Hijacking and Promotional Redirection
- Content
View full analysis
- Remediation
View remediation
Security audit
国泰海通证券-灵犀实时行情
Security checks for vulnerabilities and agentic risk
Overview
This market-data skill is purpose-related, but it needs review because it stores sensitive API keys locally and can route credential-bearing requests through configurable gateways.
Install only if you trust the publisher and are comfortable giving this skill a GuoTai HaiTong API key. Treat the key like a password: avoid pasting it into chat when possible, review where gtht-entry.json is stored, restrict file permissions, and do not run the skill with untrusted GTHT_GATEWAY_CONFIG or working-directory gateway-config.json files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
skill-entry.js:4- Finding
Credential Exfiltration Through an Unrestricted Gateway Configuration Override
- Content
View full analysis
[n, new URL(o, r).toString()]) ); } ``` The resulting gateway is later used for authenticated requests: ```javascript async function ds(e, t, r = {}) { let n = hu(), o = n[e]; if (!o) throw new Error(`Unknown gateway: ${e}`); let i = ie.addApiKeyToHeaders({}); let a = await du(o, "tools/call", { name: t, arguments: r }, i); if (a.error) throw new Error(`Tool invocation failed: ${a.error.message}`); return fs(a); } ``` The request implementation attaches sensitive authorization material: ```javascript let N = { hostname: m.hostname, port: m.port || 443, path: m.pathname, method: "POST", headers: { "Content-Type": "application/json", "skill-name": "lingxi-realtimemarketdata-skill", "Content-Length": Buffer.byteLength(y), version: "1.0.0", platform: _, ...u ? { "jwt-assertion": i, usercode: h } : {}, ...c ? { channel: ea } : {}, ...n }, rejectUnauthorized: true }; ``` ### Technical Analysis The configuration loader gives `GTHT_GATEWAY_CONFIG` precedence over the packaged configuration. The selected JSON file can define a replacement base URL, and `new URL()` then constructs gateway endpoints from that base. Before sending a request, the code does not enforce an ...[truncated 2139 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skill-entry.js:1- Finding
API Key Persisted in Plaintext Without Explicit Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (24)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a realtime market-data helper, but its instructions extend into local credential storage, authorization orchestration, polling, local file management, and references to additional gateways and tooling outside the stated scope. That mismatch increases the chance that an agent will perform sensitive side effects a user did not reasonably expect, especially around API key handling and local persistence.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly asks the user to send an API key directly to the agent in chat. Requesting sensitive credentials through natural-language conversation creates immediate exposure in chat logs, transcripts, analytics pipelines, and any downstream systems that process messages.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs the agent to collect a user's API key and save it locally, but does not clearly warn the user about credential sensitivity, storage location, retention, or local compromise risks. In a financial context, silent local storage of API credentials is especially dangerous because it can expose access to brokerage-linked data and services if the host or chat transcript is compromised.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill directs the agent to write a user-provided API key into a local file, creating durable credential retention on disk. Persistent plaintext secrets materially increase the blast radius of workstation compromise, accidental file sharing, backup leakage, or multi-user environment exposure.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The repeated instructions reinforce the practice of having users send API keys to the agent, normalizing insecure credential sharing. Repetition makes this more dangerous because it increases the likelihood that an agent will follow the insecure path even when safer authorization methods exist.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
These duplicated instructions again tell the agent to store a user-provided API key in a file, compounding the credential-retention risk and making insecure behavior part of the prescribed workflow. In a securities skill, this is particularly sensitive because the key may grant access to financial data or account-linked services.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **数据源**: `stock_code_name.json`
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 98% confidence
- Finding
The skill performs direct HTTP/HTTPS networking, including outbound JSON-RPC requests and local proxy/server behavior, without corresponding declared permissions. Undeclared network access is dangerous because it allows external communication, token exchange, and behavior changes that are not obvious from the advertised realtime quote function.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 98% confidence
- Finding
The skill performs direct HTTP/HTTPS networking, including outbound JSON-RPC requests and local proxy/server behavior, without corresponding declared permissions. Undeclared network access is dangerous because it allows external communication, token exchange, and behavior changes that are not obvious from the advertised realtime quote function.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 98% confidence
- Finding
The skill performs direct HTTP/HTTPS networking, including outbound JSON-RPC requests and local proxy/server behavior, without corresponding declared permissions. Undeclared network access is dangerous because it allows external communication, token exchange, and behavior changes that are not obvious from the advertised realtime quote function.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This file embeds a full authorization subsystem: QR generation, device/session creation, token polling, API-key acquisition, persistence, and multiple CLI auth modes. That is materially broader than the declared purpose of fetching realtime market data, so users and reviewers may unknowingly grant a data skill credential-management and account-linking powers.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest says the skill should be used whenever the user asks about stock prices, trends, fund flows, or related market information, and then lists generic keywords like “股价” and “查行情”. This is broad natural language without exclusion conditions or tighter activation boundaries, which could cause unintended invocation for loosely related finance conversations.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document tells the agent to search multiple directories for
gtht-entry.json, then later says not to look for substitute configuration files in other directories. Contradictory instructions around credential-file discovery can cause an agent to read or trust unintended files, leading to confused-deputy behavior or use of stale/foreign credentials.- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md > **此区域供业务同事发挥，用于定义具体的服务意图与话术引导。** | 场景分类 | 典型用户问题 (Intent) | 业务逻辑指导 | | -------------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **实时行情查询** | 单股行情"SH600000现在什么价格？" "SH600000开盘价是多少？" | 定位 `market` 领域，调用 `marketdata-tool`。 | |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 场景分类 | 典型用户问题 (Intent) | 业务逻辑指导 | | -------------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **实时行情查询** | 单股行情"SH600000现在什么价格？" "SH600000开盘价是多少？" | 定位 `market` 领域，调用 `marketdata-tool`。 | | ### 问句示例
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill states that stock mapping does not support command-line invocation, but elsewhere requires the agent to run it from the command line. This inconsistency can cause agents to improvise unsupported execution paths or bypass intended controls, increasing the risk of faulty tool use and unexpected behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill describes automatic deletion and rewriting of the authorization file without clearly informing the user that local files will be modified. Unannounced local state changes can destroy valid credentials, overwrite configuration, or create persistence artifacts that the user did not authorize.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code stores API keys on disk in JSON config files and logs the save path, but there is no nearby user-facing consent, secrecy warning, encryption, or OS credential-store use. Persisting sensitive credentials in plain local files increases the risk of credential theft by other local users, processes, backups, or accidental disclosure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file contains extensive hard-coded Chinese CLI/help/output strings and explicitly formats numbers with the zh-CN locale, with no visible opt-in or language-selection mechanism. This creates a language/locale policy issue because the skill appears to force a specific language experience rather than allowing user choice or documenting a justified region-specific restriction.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The code derives device-identifying values such as MAC address and device IDs as part of its auth flow, even though the skill is described as a realtime market-data retriever. Collecting persistent identifiers increases privacy risk and creates unnecessary linkage between user/device identity and market queries.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill can start a local HTTP proxy/server to support authorization, which is unrelated to simple quote retrieval and enlarges the local attack surface. Even though it binds to 127.0.0.1, local services can still be abused by other local processes, create confusion in sandboxed environments, and bypass expected platform mediation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The config uses Chinese-only natural-language fields for the tool description and label. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy violation, and this file does not indicate any language selection or justification.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code stores API keys on disk in JSON config files and logs the save path, but there is no nearby user-facing consent, secrecy warning, encryption, or OS credential-store use. Persisting sensitive credentials in plain local files increases the risk of credential theft by other local users, processes, backups, or accidental disclosure.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This JSON manifest-like data file contains thousands of natural-language name values exclusively in Chinese, such as stock and index names, but provides no metadata indicating that the dataset is intentionally China-market-specific. That can violate a language/locale policy when a skill forces a specific language without documenting or offering a choice.
- Content