T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:9- Finding
Instruction Attempts to Suppress Review of Executable Source Code
- Content
View full analysis
- Remediation
View remediation
Security audit
国泰海通证券-灵犀智能选股
Security checks for vulnerabilities and agentic risk
Overview
This stock-screening skill is broadly coherent, but it handles reusable credentials and device identifiers with too much mutable configuration and under-disclosed local persistence.
Install only if you trust the publisher and the local environment. Before use, check that no untrusted gateway-config.json or GTHT_GATEWAY_CONFIG can redirect requests, understand that the skill stores a reusable API key in plaintext, and revoke or clear the key if the machine or workspace is shared.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
skill-entry.js:1- Finding
API Key Can Be Exfiltrated Through Attacker-Controlled Gateway Configuration
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
skill-entry.js:1- Finding
Credential Files Are Searched and Modified Outside the Declared Skill Boundary
- Content
View full analysis
l.existsSync(a)); if(o)return E(o),o; let r=e.find(a=>l.existsSync(p.dirname(a)))||e[0]; if(t&&l.existsSync(t)&&r!==t) return E(r), l.copyFileSync(t,r), console.log(`✓ 已将授权文件迁移到共享目录: ${r}`), r; let c=e.find(a=>l.existsSync(a))||r; return E(c),c } ``` ```js function w(e){ let t=f(),n={apiKey:String(e||"").trim()}; l.writeFileSync(t,JSON.stringify(n,null,2)), console.log(`✓ API Key 已保存到配置文件: ${t}`) } ``` ```js function H(){ try{ let e=f(); l.existsSync(e) ? (l.unlinkSync(e),console.log("✓ 授权已清除")) : console.log("✓ 未找到授权文件") }catch(e){ console.error("清除授权失败:",e.message) } } ``` ### Technical Analysis The implementation derives multiple candidate credential paths by repeatedly moving to parent directories. It may create parent directories recursively, read a discovered credential, copy a credential to another shared directory, overwrite it, or delete it. This behavior exceeds the documentation’s stated boundary of the Skill directory and its immediate shared sibling. The code also does not use `realpath` validation to prevent symbolic-link escapes. When multiple installation ...[truncated 1096 chars]- Remediation
View remediation
other
Warning
- Location
skill-entry.js:1- Finding
Authorization Flow Collects and Transmits a Hardware MAC Address
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skill-entry.js:1- Finding
Reusable API Key Is Stored as Plaintext Without Explicit Access Restrictions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description says this skill supports natural-language stock screening and historical backtesting. However, the provided code chunk is almost entirely infrastructure for authentication and generic MCP tool calling. It handles API key persistence, token parsing, QR/cloud auth instructions, polling for authorization results, loading gateway configs, and sending authenticated JSON-RPC requests. While there are example references to tools like financial-search and backtest, the code does not contain the actual stock-selection/backtesting implementation; instead it is a generic wrapper that can call arbitrary tools. This is a material mismatch because the actual behavior exposed by this code chunk includes undeclared auth-management and broad remote tool-invocation capabilities, while the declared purpose presents a specific stock-selection/backtesting skill.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file first imposes a strict boundary limiting access to the skill directory and one sibling shared file, but later instructs the agent to search for or create API-key files across multiple parent directories. That contradiction weakens containment guarantees and can cause the agent to read from or write to unintended locations, exposing credentials or crossing workspace boundaries.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 97% confidence
- Finding
The file implements generic MCP/gateway tool invocation through sendJsonRpcRequest and mcpClient call paths, enabling access to remote tools beyond the narrowly described stock-selection function. Undeclared MCP capability is dangerous because it expands the skill's effective authority and may permit unexpected data access or remote actions through configured gateways.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 97% confidence
- Finding
The file implements generic MCP/gateway tool invocation through sendJsonRpcRequest and mcpClient call paths, enabling access to remote tools beyond the narrowly described stock-selection function. Undeclared MCP capability is dangerous because it expands the skill's effective authority and may permit unexpected data access or remote actions through configured gateways.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description says the skill is triggered by generic phrases including “选股”, “筛选股票”, “回测”, “选股策略”, and “筛选结果”. Several of these are broad everyday task phrases in a finance context, and the file does not provide explicit constraints or negative examples clarifying when the skill should not activate.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file requires the agent to append fixed Chinese disclaimer text verbatim for financial and backtest responses. Because this is a hard requirement and no user language or locale opt-in is offered, it can violate language-choice policy for users operating in other languages.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The behavior section says all environments now use the cloud authorization page and that auth --channel only exists for compatibility and no longer changes the authorization method. However, the troubleshooting table later tells users to add or remove --channel depending on environment to generate PNG QR codes or terminal Unicode QR codes, implying that the flag still materially changes behavior.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md 选股结果回测：年化收益、最大回撤、胜率 | 场景分类 | 典型用户问题 (Intent) | 业务逻辑指导 | | -------------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **多指标选股** | "涨幅大于5%且换手率大于3%的股票"，"今天涨幅超过7%的强势股" | 调用 `financial-search`。 | | **回测** | "帮我找出涨幅超5%的股票，并回测这个策略"，"筛选高换手股票，回测近一年表现" | 调用 `backtest`。 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 场景分类 | 典型用户问题 (Intent) | 业务逻辑指导 | | -------------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **多指标选股** | "涨幅大于5%且换手率大于3%的股票"，"今天涨幅超过7%的强势股" | 调用 `financial-search`。 | | **回测** | "帮我找出涨幅超5%的股票，并回测这个策略"，"筛选高换手股票，回测近一年表现" | 调用 `backtest`。 | |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 场景分类 | 典型用户问题 (Intent) | 业务逻辑指导 | | -------------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **多指标选股** | "涨幅大于5%且换手率大于3%的股票"，"今天涨幅超过7%的强势股" | 调用 `financial-search`。 | | **回测** | "帮我找出涨幅超5%的股票，并回测这个策略"，"筛选高换手股票，回测近一年表现" | 调用 `backtest`。 | |
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes a domain-specific stock-selection/backtesting skill, but the entry file primarily handles authorization, API-key storage, gateway loading, and generic tool dispatch. This mismatch is risky because it obscures the true behavior of the skill and makes review, consent, and least-privilege enforcement less effective.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The authorization flow gathers a MAC-derived device identifier, timestamp, and random suffix, and then displays or transmits this identifier as part of the QR/auth process. For a stock-selection skill, collecting local hardware fingerprint material is not clearly necessary and creates avoidable device-tracking and privacy exposure if logs or remote services are compromised.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code saves the API key to a JSON file in cleartext and later reuses it automatically. Cleartext credential storage is dangerous because any local user, backup system, malware, or support bundle with file access can recover the key and impersonate the user against the remote gateway.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The auth flow prints MAC address, timestamp, full QR payload, device ID, and token values directly to the console. These values can be harvested from terminal logs, screenshots, shell history captures, or support transcripts and may enable session correlation, replay assistance, or credential abuse depending on backend semantics.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Nearly all CLI prompts, help text, and status messages are fixed in Chinese, which forces a specific language experience regardless of user preference. The file does not offer any locale selection, fallback, or documented justification for a Chinese-only interface.
- Content