Security audit

HK IPO Decision Engine

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Hong Kong IPO decision-support skill, but it stores local investing preferences and review history and queries external market-data sites.

Install only if you are comfortable storing IPO preferences, watchlists, parameter versions, suggestions, and review history under ~/.hkipo-next and sending queried IPO symbols to external market-data sites. Avoid entering unnecessary personal financial details, delete the local data when no longer needed, and independently verify investment, broker, tax, and compliance decisions.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill invokes a bundled CLI and explicitly documents access to local config/database files, persistent writes under the user's home directory, and network-backed data retrieval, yet it declares no permissions. This creates a transparency and consent problem: a caller may treat the skill as low-risk while it can read/write local state and reach external sources, increasing the chance of unintended data exposure or side effects.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The documented purpose presents the skill as a narrow IPO scoring/decision tool, but the referenced runtime appears to expose substantially broader functionality: scraping numerous third-party sources, managing local persistent state, importing external suggestions, and offering many auxiliary commands. This mismatch is dangerous because it can conceal a much larger attack surface than users expect, including network collection, file manipulation, and ingestion of untrusted external data that may alter local parameter versions or review artifacts.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The CLI exposes a profile workflow that collects personal financial data and ties the skill to local file persistence, which extends beyond the stated IPO scoring/decision-card scope. In an agent setting, this can prompt unnecessary collection and storage of sensitive user information, increasing privacy and data-handling risk without clear need.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: This code reads and potentially initiates creation of a local user profile file containing financial preference data, but that behavior is not clearly justified by the skill's declared purpose. Unnecessary filesystem access and profile persistence in an agent skill can expose sensitive data to other local processes, future runs, or accidental leakage.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: This is a real reliability/security issue: the code uses httpx for network access but documents and catches requests.RequestException, while requests is never imported. On an HTTP failure, the intended handler will itself raise a NameError during exception matching, causing the program to crash unexpectedly and bypass controlled error handling, which can turn a normal upstream outage or malformed response into a denial-of-service condition for callers relying on this CLI or module.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The profile flow explicitly instructs the AI to ask the user for personal financial details and write them into a local YAML file. In an agent environment, this is dangerous because it encourages persistent collection of sensitive information such as capital amount, risk appetite, and financing behavior, which may exceed user expectations and create avoidable privacy and compliance risk.

Static analysis

No suspicious patterns detected.