Security audit

国泰海通证券-灵犀智能选股

Security checks for vulnerabilities and agentic risk

Overview

This stock-screening skill mostly matches its purpose, but it handles finance-related API keys in risky and under-scoped ways that users should review before installing.

Install only if you trust the publisher and are comfortable with this skill handling a GuoTai HaiTong/Lingxi API key. Prefer the QR/cloud authorization path instead of pasting an API key into chat, review where gtht-entry.json will be stored, and revoke or rotate any key that was shared in conversation or exposed in logs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares only the `node` tool, but the documented behavior clearly includes credential handling, local file access, and remote MCP access. This under-declaration reduces transparency and can cause the host agent or user to underestimate the skill's ability to read/write auth material and invoke external services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The stated purpose is stock screening and backtesting, but the skill also acts as a credentialed authorization client and a generic MCP/JSON-RPC invoker. That gap materially expands what the skill can do beyond user expectations, increasing the risk of misuse, overbroad remote calls, and unsafe trust in a finance-sensitive context.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The file-access boundary says access must stay within the skill directory plus one shared file, but the later lookup order searches multiple parent directories. That contradiction can lead to unintended credential discovery from neighboring or ancestor locations, weakening directory isolation and increasing the chance of cross-skill credential leakage.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The file implements a substantial authorization and token-management workflow, including QR-based auth, polling, JWT extraction, API-key persistence, and gateway access, which exceeds the narrowly described stock-screening/backtesting behavior. This increases the attack surface and introduces credential-handling functionality that can expose sensitive tokens or be repurposed for unintended access if the skill is abused or integrated in a broader agent context.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The code enumerates local network interfaces and derives a device identifier from the host MAC address, then embeds it into the authorization flow. Hardware-derived identifiers are sensitive tracking data and are not necessary for a stock-selection skill, creating unnecessary privacy risk and enabling cross-session/device correlation if collected by remote services.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill explicitly instructs users to send an API Key to complete authorization, without a prominent warning that the key is a sensitive secret that should not be shared in chat or with untrusted intermediaries. In a financial skill, this is especially dangerous because exposed API credentials may grant access to protected data or account-linked services.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill writes the API key to a local JSON file in a shared/resolved directory using plain filesystem operations, without encryption, OS credential-store protections, or meaningful user warning. If another local process or user can read that file, the key can be stolen and reused to access protected backend services under the user's identity.

Static analysis

No suspicious patterns detected.