T09 · Insecure Skill Coding Practices
Error
- Location
scripts/verify_collateral.py:155- Finding
Mandatory collateral controls fail open when blacklist or relationship data is missing
- Content
View full analysis
- Remediation
View remediation
Security audit
Interbank Funding Trader
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed Chinese interbank funding assistant, but its automatic activation and collateral-checking script create financial decision risks that should be reviewed before installation.
Review before installing in any real trading workflow. The documentation is cautious about human confirmation, but the verifier script should be fixed or avoided for live collateral decisions until it fails closed on missing blacklist and relationship data and neutralizes spreadsheet formulas. Use only with confirmed internal CSV data, explicit account selection, and human trade, risk, and compliance review.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/verify_collateral.py:225- Finding
Untrusted bond codes can produce spreadsheet formula injection in TSV output
- Content
View full analysis
list[str]: codes: list[str] = [] seen_header = False for raw in text.splitlines(): line = raw.strip() if not line: continue cells = re.split(r"\t|,|，|\s+", line) first = cells[0].strip() if first.lower() in {"bond_code", "债券代码", "代码"} and not seen_header: seen_header = True continue if re.fullmatch(r"\d+", first) and len(cells) > 1: first = cells[1].strip() codes.append(first) return codes ``` ```python text = args.input.read_text(encoding="utf-8-sig") if args.input else sys.stdin.read() codes = extract_codes(text) writer = csv.DictWriter( sys.stdout, fieldnames=["mark", "bond_code", "bond_name", "used_rating", "custodian", "reason"], delimiter="\t", lineterminator="\n", ) writer.writeheader() for code in codes: writer.writerow(verify(code, bonds.get(code), account)) return 0 ``` ### Technical Analysis `extract_codes()` accepts the first parsed cell without enforcing a bond-code syntax. The value is subsequently returned in the `bond_code` field even when it does not match the local bond directory. The TSV writer performs CSV quoting and delimiter escaping, but those protections do not neutralize spreadsheet formulas. Values beginning with `=`, `+`, `-`, or `@` may be interpreted as formulas when the generated TSV is opened or pasted into spreadsheet software. Because this workflow is explicitly designed to process text pasted from Excel and produce tabular output, spreadsheet consumption is a foreseeable output context. Formula behavior depends on the spreadsheet application, version, security configuration, and whether the ...[truncated 1725 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)
MCP Config Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
- Content
md ## 安全规则 - 不在资金交易 skill 中保存 iFinD 密钥。 - 不复述 iFinD `mcp_config.json` 中的 token。 - 不把 iFinD 查询结果中的敏感账户或内部字段暴露给外部对手。 - 开源资金交易 skill 时，不包含 iFinD 的密钥、配置或本地下载包。
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The markdown instructions from L08 onward are written entirely in Chinese and prescribe the skill's operating mode and output structure in Chinese, but they do not offer the user a language choice or explicit opt-in. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill enables implicit invocation with no activation constraints, so the agent may automatically enter a specialized financial-trader workflow based on broad user phrasing. In this context, that is risky because the skill is designed to influence repo funding, liquidity management, counterparty communication, and collateral eligibility decisions, which can cause the model to provide high-trust domain-specific trading guidance even when the user did not explicitly request this skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This markdown file is written entirely in Chinese and provides no indication that users may choose another language or that the Chinese-only constraint is intentional and justified. Under the policy for natural-language violations, forcing a specific language without opt-in is a reportable locale-policy issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document presents all instructions, headings, and operational guidance exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or a documented justification is a reportable issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The entire skill reference is written in Chinese and does not indicate that users may choose another language or locale. Per the policy, a skill that enforces a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are broad enough to activate on ordinary user requests like '帮我验券' or '这些券能不能押', which can cause the skill to take over in contexts where the user did not explicitly request this constrained workflow. In a financial decision-support skill, unintended activation is risky because it may produce authoritative eligibility judgments using default/template account logic, increasing the chance of misleading trading or collateral decisions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code emits user-facing status and error messages only in Chinese, such as the default-account notice and account-mismatch error. That is a natural-language locale constraint embedded in the code, and the file does not provide any user opt-in or documented justification for forcing that language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown template uses Chinese headings and field labels throughout, which can impose a specific language/locale on users without opt-in. The file does not state that it is intended only for a Chinese-speaking or region-specific workflow, nor does it offer alternatives.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template headings and field labels from L03 onward are written in Chinese, which imposes a specific language on users. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific; neither is indicated in this file.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Line L020 states '中文为主', which sets a default language policy for the skill's outputs. The rule allows locale constraints only when the user is offered a language choice or the constraint is clearly documented and justified as region-specific; this file does not provide user opt-in or an explicit choice mechanism.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The file is entirely written to operate in Chinese and prescribes fixed Chinese reply templates, but it does not state that language choice depends on user preference or provide an opt-in for another language. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file presents all operational instructions in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content