T09 · Insecure Skill Coding Practices
Error
- Location
agents/technical_analyst.md:11- Finding
User-Controlled Ticker Interpolated into Shell Commands
- Content
View full analysis
- Remediation
View remediation
Security audit
trading-agents.skill
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent stock-analysis workflow, but it unsafely places user-provided tickers into shell commands and output filenames, so it should be reviewed before use.
Before installing, treat this as a review-needed skill: run it only in a sandboxed workspace, use simple validated stock symbols, avoid passing untrusted ticker text, and prefer a version that validates tickers, avoids shell command strings, confines output paths, and ships a reviewed lockfile. Remember that its output is research assistance, not financial advice.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_market_data.py:200- Finding
Ticker-Derived Output Filenames Allow Path Traversal
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
pyproject.toml:7- Finding
Unpinned and Unlocked Runtime Dependency Installation
- Content
View full analysis
=1.18.51", "numpy>=2.0.2", "pandas>=2.3.3", "yfinance>=1.2.0", ] ``` No `uv.lock` file is present in the audited project structure. ### Technical Analysis The Skill installs the newest `uv` version available and permits any dependency release equal to or newer than the listed minimum. Without a committed lockfile, the exact direct and transitive dependency graph can change between runs without any corresponding change to the audited Skill. Python packages execute code when imported, and installation mechanisms may also process build-system code for source distributions. Consequently, a compromised package release, compromised maintainer account, malicious transitive dependency, or unsafe package-index configuration could introduce code that was never part of the reviewed artifact. This finding does not establish that any currently named package is malicious. It identifies a supply-chain control weakness that allows future dependency contents to change after review. ### Attack Path 1. A dependency or transitive dependency publishes a compromised release that satisfies the broad version constraints, or the configured package source serves an attacker-controlled artifact. 2. A user follows `SKILL.md` and runs `pip install -U uv` or `uv syn ...[truncated 950 chars]- Remediation
View remediation
" ``` 4. Prefer binary wheels from a trusted, explicitly configured package index. Verify the index URL and prevent unintended fallback to untrusted repositories. 5. Use hash verification where supported and review hashes whenever dependencies are updated. 6. Remove dependencies that are not required by the shipped scripts. In particular, verify whether `akshare` is necessary, because the audited scripts directly import only `yfinance`, `pandas`, and standard-library modules. 7. Integrate dependency vulnerability and provenance scanning into release review. 8. Perform dependency upgrades as explicit, reviewed changes rather than allowing runtime synchronization to select arbitrary future versions. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents a sophisticated trading-analysis orchestration skill built around multiple specialized Claude subagents that collaborate to produce trading recommendations. The actual code does not implement any agent orchestration, debate, analysis pipeline, or decision-making framework. It simply retrieves market and financial data for a ticker using yfinance, stores it in JSON, and prints a few summary fields. While fetching market data could be a supporting component of a trading-analysis system, this code chunk’s primary behavior is data collection/export, which is materially narrower and different from the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description describes a broad multi-agent trading analysis framework modeled after TradingAgents, with many specialized subagents collaborating on investment decisions. The supplied code chunk does not do any orchestration or agent simulation. It is a standalone technical-analysis utility focused solely on computing price-based indicators for a ticker and saving them to JSON. While technical analysis is one component mentioned in the description, the actual code's primary purpose is far narrower and materially different from the declared system-level functionality. Therefore this is a clear description/behavior mismatch.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to create report files and working artifacts, but it does not declare any explicit tool scope such as permissions or allowed-tools. In a multi-agent workflow that writes multiple outputs, missing tool boundaries increases the chance of unintended file writes or broader filesystem access than reviewers expect.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation criteria are very broad, causing the skill to trigger on a wide range of ordinary investment conversations. In context, this is risky because the skill launches a costly, multi-step workflow with subagents, external data retrieval, and file generation, potentially causing unnecessary tool use, excess token spend, and user confusion without clear intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The debate record format requires Chinese headings like "辩论背景", "第 N 轮辩论", and "研究经理总结" regardless of the user's requested language. Elsewhere the file also mixes Chinese-specific output examples, but this section is a direct formatting requirement and does not offer the user a language choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Lines L140-L147 require the report to include a section titled "数据来源" and provide citation examples entirely in Chinese. This imposes a specific language/locale convention on output without user opt-in or a stated regional justification, which matches the language-policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instructions require the final report to include a section titled
数据来源and use Chinese-language citation examples, which imposes a specific language format. There is no opt-in, user choice, or documented regional justification for forcing this locale-specific output.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file requires source attribution and source-section formatting using Chinese-language examples and headings such as "数据来源," and it prioritizes Chinese-language platforms as mandatory for certain stocks. This imposes a specific language/locale convention on the report without offering the user a language choice or documenting a justified locale restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill hard-codes Chinese-language output/examples for parts of the report without any user opt-in, which can override user preferences and create instruction-conflict behavior in downstream agent outputs. In a trading-analysis skill, this is not directly code-execution or data-exfiltration dangerous, but it can degrade reliability, cause confusing mixed-language reports, and make the agent easier to steer away from the user's requested format.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This markdown skill instructs the agent to save output to
{OUTPUT_DIR}/bear_case.md, which affects user data/filesystem state. The file does not include any warning or disclosure that it will write a file, nor any confirmation or caution about overwriting or creating output artifacts.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown skill instructs saving a report to
{OUTPUT_DIR}/bull_case.md, which is a file write operation. The description does not include any warning or disclosure that the skill will create or overwrite a file, so users may not realize it modifies the filesystem.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown skill directs the agent to write a report to
{OUTPUT_DIR}/news_analysis.md, which affects local user data. The description does not include any warning about file creation/overwrite behavior or its impact on the workspace.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
Line L34 includes the Chinese term
拨备覆盖率in otherwise English instructions. This can impose a language expectation without explicit user opt-in or explanation of why a multilingual term is required.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Line L57 directs the agent to save output to
{OUTPUT_DIR}/risk_assessment.md, which is a file write operation. The markdown does not include any warning or disclosure that the skill will create or overwrite a file in the user's filesystem.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown skill explicitly instructs the agent to save a report to
{OUTPUT_DIR}/trading_recommendation.md, which is a file write operation. The description provides no warning or disclosure that the skill will create or overwrite a file on the user's system.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The package metadata says "Add your description here," which conflicts with the manifest's detailed claim that this skill orchestrates multi-agent stock analysis and trading recommendations. This is an intent/documentation mismatch because the embedded project description does not describe the actual stated purpose at all.
- Content
Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The module docstring frames the script as computing technical indicators, while the implementation also creates an output directory and writes a JSON file to it. Because the documentation's usage text mentions an output path and says it outputs JSON, this is only a mild mismatch at the top-level description rather than a hidden capability.
- Content