CMC Kline Data Collector

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:58 AM UTC
• Version: 1.0.0

Overview

The skill is a public crypto market data helper with some broken or inaccurate functionality, but no evidence of hidden, destructive, or data-stealing behavior.

Before installing, treat this as a small public market-data utility rather than a hardened production skill. Review or fix the wrapper bugs before relying on JSON/CSV export, and only enable the documented cron command if you want repeated CoinMarketCap requests and daily local output files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 整体上，这段代码的核心目的与声明基本接近：它确实围绕 CoinMarketCap 历史行情数据抓取和技术指标计算展开，没有发现明显的越权资源访问或恶意/无关能力。但仍存在实质性描述偏差。首先，声明强调支持 JSON/CSV 输出；JSON 保存基本可见，而 CSV 保存函数只是构造了一个空 quotes 的临时对象并调用 save_csv，没有把传入的 data 转换写入，按当前代码片段看并不能真实输出声明中的 CSV 内容。其次，代码额外提供了 to_js_object，用于生成无引号的 JS 文本对象，这属于未声明的输出能力。再次，fetch_symbol(days=35) 的 days 参数在实际调用中没有用于控制 client.get_historical，因此接口承诺与行为不符。最后，fetch_symbol 仅输出最近 7 天的数据，而声明表述为获取历史 K 线数据，容易让人理解为可输出完整历史区间。因此应判定为存在描述与行为不完全一致的 mismatch，但偏差主要是功能实现和输出形式上的不一致，而非严重越权。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 代码与描述部分一致之处是：它确实从 CoinMarketCap 获取加密货币历史/K线数据，并按 symbol 批量抓取。不存在明显越权能力，主要外部资源也是 CoinMarketCap API。 但描述中的两个关键能力在该代码块中都没有体现：1）没有任何 EMA、RSI 或其他技术指标计算；2）没有将结果导出为 JSON/CSV 的逻辑，仅返回 Python 数据模型对象。因此该代码块的实际行为只覆盖了描述的一部分，且缺少描述中的核心功能，属于描述与行为不一致。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 声明描述的是一个完整的数据获取与技术指标计算工具，核心能力包括外部数据拉取和指标计算。但提供的代码仅是数据处理/输出模块：创建输出目录、按日期或最近天数过滤已有数据、导出 JSON/CSV、打印数据摘要。这与“支持 JSON/CSV 格式输出”部分一致，但缺少声明中更核心的两项能力：1) 从 CoinMarketCap 获取历史 K 线数据；2) 自动计算 EMA7、EMA30、RSI14 等技术指标。代码也没有显示任何网络访问、API 调用或指标计算逻辑。因此该代码片段与声明用途存在实质性不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: 声明的技能描述包含三部分核心能力：1）从 CoinMarketCap 获取加密货币 K 线历史数据；2）自动计算 EMA7、EMA30、RSI14；3）支持 JSON/CSV 格式输出。提供的代码片段只覆盖第 2 部分中的技术指标计算，而且还附带一个特定的数据裁剪与格式化行为：要求至少 30 条 Quote，计算后仅返回最近 7 天，且字段被压缩为 O/H/L/C/E7/E30/R14/D。代码中没有任何网络请求、CoinMarketCap API 调用、认证、HTTP 客户端或数据抓取逻辑，因此“获取数据”这一声明与实际代码不符。也没有 CSV 序列化、JSON 导出、文件写入或响应格式选择逻辑，因此“支持 JSON/CSV 格式输出”也未体现。虽然指标计算部分与描述一致，但整体描述显著超出了该代码实际实现的范围，因此应判定为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 代码片段只包含 `Quote` 和 `KlineData` 两个数据类及其辅助方法。其行为主要是：保存 OHLCV/市值等字段、解析时间、按日期范围或最近 N 天过滤数据、生成 CSV 行和 JSON 字典。描述中声称的两个核心能力——1) 从 CoinMarketCap 获取加密货币历史 K 线数据；2) 自动计算 EMA7、EMA30、RSI14 等技术指标——在该代码中均未出现。虽然 JSON/CSV 输出与描述部分一致，但整体主功能明显不完整且与声明不符，因此应判定为描述与实际行为不匹配。

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises capabilities that involve network access and file writing, but it does not declare any explicit tool scope or permissions. In an agent environment, this weakens least-privilege controls and can allow broader-than-expected external requests or filesystem modification if the skill is invoked automatically.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill documents unattended cron execution and output file generation to fixed paths, but does not clearly warn about automatic file creation, overwrite behavior, or the operational risk of scheduled runs. In practice, this can lead to silent data replacement, unexpected disk usage, and repeated external network access without operator awareness.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The module description presents the skill's purpose entirely in Chinese, and the file continues using Chinese-only docstrings/comments. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The class docstring and subsequent user-facing/docstring text are Chinese-only, with no indication that other languages are supported or that the user opted into this locale. This creates a language policy issue for a general-purpose skill file.

External Transmission

Medium

• Category: Data Exfiltration

Content

"""

# CMC API 配置
CMC_BASE_URL = "https://api.coinmarketcap.com/data-api/v3.1"

# 计价货币 ID: 2781 = USD
CONVERT_ID = 2781

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: Several user-facing comments in the file are written only in Chinese, including configuration labels and explanations. This imposes a specific language context without any indication of user opt-in or documented locale justification, which matches the language/locale policy concern.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The class docstring at L13 is written in Chinese, and the method docstrings and inline user-facing descriptions in this file are also Chinese-only. This creates a locale/language constraint in the skill's natural-language interface without offering any user choice or documenting that the skill is intentionally region-specific.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: This code file contains natural-language text in Chinese in the module title and class docstring, and later prints summaries using Chinese-only labels. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy issue when no alternative or configuration is provided.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: This code file contains natural-language documentation and inline comments entirely in Chinese, including the module docstring and function descriptions. Under the stated policy, forcing a specific language without user opt-in or a documented regional justification is a language/locale policy violation.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: This code file contains multiple Chinese-only docstrings and comments, such as at L012, L029, L041, and throughout the file, with no indication that the skill is region-specific or that users can choose a language. Per the policy, forcing a specific language without opt-in is a natural-language policy concern.

Static analysis

No suspicious patterns detected.