T08 · Insecure Dependencies
Warning
- Location
package.json:21- Finding
Python Dependencies Declared in the npm Ecosystem and Installed Without Version Pinning
- Content
View full analysis
- Remediation
View remediation
Security audit
Finance Analysis
Security checks for vulnerabilities and agentic risk
Overview
This finance skill needs Review because its valuation and risk commands present fixed demo outputs as stock-specific financial analysis.
Install only if you treat the valuation and risk outputs as illustrative, not investment advice. Verify any financial analysis independently, review all assumptions and data sources, protect your Tushare token, and avoid automated npm-based installation of this package until the dependency metadata is corrected.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Warning
- Location
scripts/finance_analysis.py:126- Finding
Stock-Specific Valuation and Risk Commands Return Fixed Demonstration Results
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The entire skill description, examples, and user-facing messaging are written in Chinese, and there is no indication that other languages are supported or that the user can choose their preferred language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is documented and justified.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill documents use of an environment variable token and invokes a local script, but it does not declare any explicit tool scope or permissions boundaries. That can lead to overbroad execution context where an agent may access environment data implicitly, making secret exposure or unintended capability use more likely.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code file contains natural-language descriptions and CLI output that assume Chinese as the only supported language, starting from the module docstring and continuing throughout the interface. The policy explicitly flags language or locale constraints when they are forced without user opt-in or documented justification.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The DCF valuation command presents itself as performing stock-specific analysis, but it only prints hard-coded example assumptions and a fixed result that ignores the provided stock code. In a finance-analysis skill, this is dangerous because users may treat fabricated output as investment guidance, leading to materially harmful decisions under false pretenses.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The relative valuation feature claims to evaluate the requested stock, but it emits fixed multiples, a fixed premium, and a fixed recommendation regardless of input. In the context of a financial analysis tool, this is misleading functionality that can induce users to rely on counterfeit analytics as though they were evidence-based market assessments.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The risk assessment command outputs fixed solvency, profitability, growth, score, and 'low risk' conclusions without analyzing the supplied stock. Because the skill is explicitly marketed for risk evaluation, the false appearance of analytical rigor can cause users to underestimate investment risk and make unsound financial decisions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
All user-facing strings, comments, and CLI output are in Chinese, and the file does not provide any mechanism for language selection or indicate that the tool is intentionally limited to a Chinese-speaking or region-specific audience. That creates a natural-language locale policy concern because the skill imposes a single language without user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The tool emits explicit investment recommendations such as '可以买入', '值得买入', and '强烈买入' based on a simplistic heuristic, without any disclaimer that the output is informational only and not financial advice. In a finance-analysis skill, users are likely to rely on these outputs for real trading decisions, which increases the chance of financial harm from misleading or oversimplified guidance.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. The natural-language content, including the description and usage instructions, is entirely in Chinese with no indication that users may choose another language, which can be read as forcing a specific language without opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill states that a TUSHARE_TOKEN must be exported, but it does not clearly warn users that the tool sends authenticated requests to an external market-data provider. Users may unknowingly transmit data or use sensitive credentials without understanding the third-party dependency and trust boundary.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The manifest uses only Chinese natural-language metadata in the description and author fields, which can imply a fixed language experience for users without offering an alternative or documenting that the skill is intentionally Chinese-only. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content