Security audit

国泰海通证券-灵犀实时行情

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed authenticated market-data integration, but it should be installed only if the user trusts the publisher and is comfortable storing an API key locally.

Before installing, verify the publisher and the GTJA/GTHT relationship. Prefer the QR authorization flow over pasting an API key into chat, and understand that the key is stored locally in a shared JSON file and will be reused for future market-data calls.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The documentation broadens the skill from quote lookup into credential acquisition, token polling, and local secret persistence. Even if intended for onboarding, this is a materially different security-sensitive function than the stated purpose, and it normalizes secret-handling behavior inside an otherwise data-query skill.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: Instructing the agent to accept a user-provided API key and store it locally creates a direct credential collection and retention path. Secrets transmitted in chat may be logged, exposed to operators, leaked via prompt history, or mishandled by the agent, making this a real secret-management vulnerability.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The authorization design includes MAC address in QR/session generation, which introduces device fingerprinting beyond what is necessary for simple quote retrieval. Collecting stable hardware identifiers raises privacy and tracking risks, and if reused across systems could facilitate unintended user/device correlation.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file implements a substantial authorization subsystem: QR-code generation, device/session ID generation, polling for tokens, API-key persistence, and auth CLI entrypoints. This is materially beyond the declared purpose of a realtime market-data skill and increases the attack surface by introducing credential handling, local state, and authentication workflows that can be abused or misused if the skill is invoked in unexpected contexts.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code exposes local HTTP server/proxy behavior (`createServer` handling `/query-key`) unrelated to simple market-data retrieval. Even if bound to localhost, this unnecessarily expands the skill’s reachable surface and can be abused by local processes or browser contexts to trigger token-query behavior and interact with authorization flows.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The authorization flow derives a device identifier from MAC addresses and embeds it into QR/auth material. Collecting stable device-identifying information is not justified by the manifest’s stated quote-fetching purpose and creates unnecessary privacy risk and tracking potential.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The instructions tell the agent to store a user-supplied API key locally but do not present a clear warning about the risks of sharing secrets in chat or storing them on disk. In this context, the missing warning materially increases the chance of credential disclosure and unauthorized reuse.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code injects the API key/JWT into JSON-RPC requests and headers as part of tool calls, but the flow provides little assurance of explicit user awareness or granular consent when secrets are transmitted. In a broader agent environment, this can lead to silent credential use against remote gateways beyond what a user expects from a market quote skill.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code injects the API key/JWT into JSON-RPC requests and headers as part of tool calls, but the flow provides little assurance of explicit user awareness or granular consent when secrets are transmitted. In a broader agent environment, this can lead to silent credential use against remote gateways beyond what a user expects from a market quote skill.

Ssd 3

High

Confidence: 98% confidence
Finding: This text explicitly instructs the agent to ask the user to send their API key in chat, creating a natural-language secret collection channel. Chat is often logged and observable by systems or staff, so this pattern materially increases the risk of credential theft, replay, and accidental retention.

Ssd 3

High

Confidence: 99% confidence
Finding: The workflow directs the agent to save a pasted API key into a local JSON file, turning credential collection into persistent secret retention. This compounds risk by exposing the key both in chat history and on disk, where it may be readable by other processes, backups, or users.

Ssd 3

High

Confidence: 98% confidence
Finding: This repeated instruction reinforces the insecure behavior of asking the user to transmit an API key in chat. Repetition makes the unsafe pattern more likely to be followed consistently, increasing the probability of credential compromise across deployments.

Ssd 3

High

Confidence: 99% confidence
Finding: This section again specifies saving a user-provided API key from chat into a local JSON file, constituting an explicit secret-retention workflow. In a financial-data context, such keys may provide access to account-linked services, so local plaintext persistence meaningfully raises the consequences of host compromise, logging exposure, or operator error.

Static analysis

No suspicious patterns detected.