jrj-quote-skill金融界A股行情数据

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:41 AM UTC
• Version: 1.0.1

Overview

The skill mostly does what it says, but its script can send the API key to an undocumented, arbitrary HTTP or HTTPS endpoint if JRJ_API_URL is set.

Review before installing. Use this only with a JRJ_API_KEY you are comfortable using from this environment, and do not set JRJ_API_URL unless you fully trust the destination. The publisher should remove or strictly validate the endpoint override so credentials are sent only over HTTPS to the intended JRJ host.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/kline.js:13

Finding

API Key Disclosure Through an Arbitrary Plaintext API Endpoint

Content

View full analysis

{ const protocol = url.protocol === 'https:' ? https : http; const req = protocol.request(url, { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-API-Key': API_KEY, }, }, (res) => { let data = ''; res.on('data', chunk => data += chunk); res.on('end', () => { try { const json = JSON.parse(data); if (json.code !== 0) { reject(new Error(`API error [${json.code}]: ${json.msg}`)); } else { resolve(json.data); } } catch (e) { reject(new Error(`Response parsing failed: ${e.message}`)); } }); }); ``` ### Technical Analysis The script reads its destination from the undocumented `JRJ_API_URL` environment variable without validating the protocol or hostname. It then attaches the sensitive `JRJ_API_KEY` to every request through the `X-API-Key` header. If `JRJ_API_URL` specifies an HTTP URL, the script deliberately selects Node.js's plaintext `http` client. If it specifies an a ...[truncated 2307 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares an environment variable requirement (JRJ_API_KEY) but does not define any explicit tool scope such as permissions or allowed-tools. That omission weakens least-privilege controls because an agent runtime may permit broader execution or network behavior than intended when handling secrets and script-based workflows.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

bash

# 调用 API 获取实时行情
curl -X POST "https://quant-gw.jrj.com/v1/quote/realtime" \
  -H "X-API-Key: ${JRJ_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"symbols": ["600036.SH", "000001.SZ"]}'

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This file presents all instructions and guidance exclusively in Chinese, beginning with the title and continuing throughout the document. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue when no alternative or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file presents all instructions, examples, and error descriptions exclusively in Chinese, which can constitute a language/locale policy violation when no user opt-in or alternative language option is provided. The file does not indicate that the API reference is intentionally region-specific or that users may choose another locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language strings in the file, including the main description and CLI help, are presented only in Chinese. This imposes a specific language on users without any opt-in, alternative locale, or documented justification for the restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This script sends a POST request to a remote API and includes both the user-supplied symbol/query parameters and the JRJ_API_KEY in request headers. Although the file header documents the required environment variable, there is no explicit warning or disclosure to the user at the point of execution that data and credentials will be transmitted to an external service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.