T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/portfolio_ledger.py:139- Finding
Path Traversal Allows Arbitrary JSON File Overwrite
- Content
View full analysis
- Remediation
View remediation
Security audit
股票投资价值评分 / Stock Portfolio Investment Scoring
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent A-share analysis tool, but it needs review because it auto-runs an unverified npm data client and contains a local snapshot write bug that can overwrite JSON files.
Use this only in a dedicated workspace, review or preinstall the npm data client yourself instead of allowing automatic `npx -y` execution, and avoid storing real portfolio screenshots or holdings unless you are comfortable with local plaintext files. Do not use `--apply` calibration or connector write actions unless you understand the exact files or simulated-account state being changed, and patch date validation in the snapshot command before relying on it.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:59- Finding
Automatic Execution of an Unverified npm Package
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (37)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Registry release management, locking, archival, and atomic replacement are administrative filesystem operations that materially differ from stock analysis. When such stateful configuration management is undisclosed, it raises integrity risks: the skill can alter future scoring behavior, persist changes, and manipulate local files under a benign-seeming advisory label.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Registry release management, locking, archival, and atomic replacement are administrative filesystem operations that materially differ from stock analysis. When such stateful configuration management is undisclosed, it raises integrity risks: the skill can alter future scoring behavior, persist changes, and manipulate local files under a benign-seeming advisory label.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Registry release management, locking, archival, and atomic replacement are administrative filesystem operations that materially differ from stock analysis. When such stateful configuration management is undisclosed, it raises integrity risks: the skill can alter future scoring behavior, persist changes, and manipulate local files under a benign-seeming advisory label.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Registry release management, locking, archival, and atomic replacement are administrative filesystem operations that materially differ from stock analysis. When such stateful configuration management is undisclosed, it raises integrity risks: the skill can alter future scoring behavior, persist changes, and manipulate local files under a benign-seeming advisory label.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Registry release management, locking, archival, and atomic replacement are administrative filesystem operations that materially differ from stock analysis. When such stateful configuration management is undisclosed, it raises integrity risks: the skill can alter future scoring behavior, persist changes, and manipulate local files under a benign-seeming advisory label.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Registry release management, locking, archival, and atomic replacement are administrative filesystem operations that materially differ from stock analysis. When such stateful configuration management is undisclosed, it raises integrity risks: the skill can alter future scoring behavior, persist changes, and manipulate local files under a benign-seeming advisory label.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Registry release management, locking, archival, and atomic replacement are administrative filesystem operations that materially differ from stock analysis. When such stateful configuration management is undisclosed, it raises integrity risks: the skill can alter future scoring behavior, persist changes, and manipulate local files under a benign-seeming advisory label.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Registry release management, locking, archival, and atomic replacement are administrative filesystem operations that materially differ from stock analysis. When such stateful configuration management is undisclosed, it raises integrity risks: the skill can alter future scoring behavior, persist changes, and manipulate local files under a benign-seeming advisory label.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Registry release management, locking, archival, and atomic replacement are administrative filesystem operations that materially differ from stock analysis. When such stateful configuration management is undisclosed, it raises integrity risks: the skill can alter future scoring behavior, persist changes, and manipulate local files under a benign-seeming advisory label.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation includes write-capable operations for modifying watchlists and placing simulated trades, which exceeds an analysis-only expectation and increases the skill's action surface. Even with a note about requiring explicit user confirmation, embedding these procedures in the skill raises the risk of unintended state changes, social-engineering abuse, or misuse by downstream agents that treat the file as operational authority.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file immediately presents all user-facing natural-language documentation in Chinese, and this pattern continues throughout the changelog. Under the policy, forcing a specific language without opt-in or a documented region-specific justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README is primarily written in Chinese and identifies the skill with a Chinese title, while only providing a brief English TL;DR. This indicates a default language constraint without stating that users may choose another language or that the locale restriction is required for compliance or regional operation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 81% confidence
- Finding
The manifest omits an explicit tool/permission scope even though the documented workflow reads and writes local files. In agent environments, undeclared file access weakens least-privilege guarantees and can let the skill operate with broader filesystem capabilities than a reviewer or user expects.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill says it does not auto-trade, but the documentation includes a path to use trading connectors for simulated order placement. Even if limited to simulated trading, introducing order-placement logic in a finance skill increases operational risk and can blur boundaries between analysis and execution, which matters greatly in high-stakes financial contexts.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill says it does not auto-trade, but the documentation includes a path to use trading connectors for simulated order placement. Even if limited to simulated trading, introducing order-placement logic in a finance skill increases operational risk and can blur boundaries between analysis and execution, which matters greatly in high-stakes financial contexts.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Claiming 'Pure Python stdlib' while requiring
npxand an external package is a supply-chain transparency issue. Users and reviewers may underestimate the skill's dependency footprint and miss the added risk of installing and invoking external tooling.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file presents the skill context and operational instructions in Chinese for the descriptive portion, which imposes a specific language choice without offering the user an alternative or documenting a justified locale restriction. This matches the policy category for language or locale constraints applied without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file begins with a fully Chinese-language title and the entire playbook is written in Chinese, with no indication that users may choose another language or that the skill is limited to a Chinese-only audience. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The playbook explicitly instructs the agent to use WebSearch for news when the connector is unavailable, expanding data acquisition to arbitrary external web sources. In a financial-analysis skill, this creates an unbounded retrieval path that can pull in prompt-injection content, unreliable market rumors, or privacy-leaking queries outside the declared stock-data workflow.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The playbook directs the agent to persist parsed holdings extracted from screenshots into local workspace files for later reuse. Holdings, cost basis, and position sizes are sensitive financial data, so undeclared local retention increases privacy and data-lifecycle risk, especially if users expect ephemeral analysis or if other skills/processes can access the workspace.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations in natural language content. This markdown file provides all operational instructions exclusively in Chinese and does not indicate that users may choose another language or that the language restriction is justified by a region-specific requirement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The file specifies that event labels '应使用标准中文标签', which imposes a specific language requirement in the skill behavior. The document does not offer a user language choice or explain a justified locale-specific constraint, so this appears to violate the language/locale policy rule.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code file contains natural-language strings and documentation entirely in Chinese, including the top-level description and all generated report text. Under the policy rule, forcing a specific language without user opt-in is a locale-policy issue because users are not given any language/locale choice and no region-specific justification is stated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The generated summary strings are hard-coded in Chinese, which imposes a specific language on users without any opt-in, configuration, or justification. This is a natural-language policy issue because the skill does not offer language selection or document that it is intentionally region-specific.
- Content