证券监管监控

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:51 AM UTC
• Version: 1.0.0

Overview

This skill is a securities-page monitoring helper, but it relies on recurring root-path scripts outside the reviewed package and includes under-scoped WeCom notification instructions.

Install only if you already trust and manage the /root/monitoring/securities deployment. Confirm the cron entry, script ownership, permissions, and cleanup policy; run it under a least-privileged account if possible; and verify the WeCom recipient before any notification is sent.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/run_monitor.sh:9
• Finding: Execution of Unverified External Monitoring Scripts<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/run_monitor.sh:9-24` - `scripts/check_updates.sh:9-21` **Vulnerability Type**: Execution of mutable code outside the audited Skill package **Risk Level**: High ### Vulnerable Code `scripts/run_monitor.sh`: ```bash MONITOR_DIR="/root/monitoring/securities" if [ ! -d "${MONITOR_DIR}" ]; then exit 1 fi cd "${MONITOR_DIR}/scripts" && bash crawl_all.sh ``` `scripts/check_updates.sh`: ```bash MONITOR_DIR="/root/monitoring/securities" if [ ! -d "${MONITOR_DIR}" ]; then exit 1 fi cd "${MONITOR_DIR}/scripts" && bash check_notifications.sh ``` ### Technical Analysis The packaged scripts delegate their core functionality to shell scripts stored outside the audited project. They verify only that `/root/monitoring/securities` is a directory; they do not verify: - The ownership or permissions of the directory and target scripts. - Whether the target is a symbolic link. - The identity or cryptographic integrity of the scripts. - Whether the scripts correspond to a reviewed release. - Whether the invoking process has unnecessary elevated privileges. Consequently, the effective implementation of the Skill is not present in the reviewed artifact and can change independently after review. Invoking `bash` on these mutable files grants them all privileges available to the Skill process. The documented cron configuration further increases exposure because it repeatedly invokes `/root/monitoring/securities/scripts/crawl_all.sh`. Although scheduled monitoring is relevant to the declared functionality and no automatic cron installation is included in this package, scheduling an unverified external script turns any later modification into recurring execution. ### Attack Path 1. An attacker or compromised administrative process obtains write access to `/root/monitoring/securities/scripts`, one of its target scripts, or a component involved in deploying that external directory. 2. The attacker replaces `cr ...[truncated 1041 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bundle `crawl_all.sh`, `check_notifications.sh`, and their dependencies inside the reviewed Skill package. 2. Resolve executable paths relative to the trusted script directory rather than a mutable absolute installation: ```bash SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)" exec bash "${SCRIPT_DIR}/crawl_all.sh" ``` 3. Before execution, reject symbolic links and verify that each target is a regular file owned by the expected account with no group or world write permissions. 4. If external deployment is unavoidable, pin and verify a cryptographic digest or signed manifest before every execution. 5. Run the monitoring process and its scheduled task as a dedicated, unprivileged service account rather than root. 6. Limit filesystem access to a dedicated data directory and grant only the network access needed for the declared regulatory sites and scraping service. 7. Require explicit user confirmation before creating a schedule, document how to remove it, and point the schedule only to immutable, integrity-checked code. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/api.md:53
• Finding: Hard-Coded WeCom Recipient Can Misdirect Monitoring Notifications<![CDATA[ ## Vulnerability Details **File Location**: `references/api.md:53-61` **Vulnerability Type**: Hard-coded notification destination **Risk Level**: Medium ### Vulnerable Code ```json { "name": "message", "parameters": { "action": "send", "channel": "wecom", "to": "yumin1_cj" } } ``` ### Technical Analysis The documented Agent workflow supplies a fixed WeCom recipient, `yumin1_cj`, rather than a recipient derived from trusted configuration or explicitly confirmed by the requesting user. Elsewhere, the Skill tells users they may ask the Agent to send monitoring updates to them. An Agent following this API example could therefore send notification contents to the hard-coded account instead of the intended requester. The package does not contain code that automatically performs this transmission, so exploitation depends on the Agent or operator following the documented example. Nevertheless, API documentation is part of the Skill's operational instructions and can directly influence tool calls. ### Attack Path 1. Regulatory monitoring produces a notification or difference report. 2. A user asks the Agent to send the report through WeCom. 3. The Agent follows the supplied `message` tool example without independently resolving and confirming the destination. 4. The Agent sends the report to `yumin1_cj`. 5. If that identity does not belong to the intended user, the report is disclosed to an unintended recipient. ### Impact Assessment The issue can cause unauthorized disclosure of monitoring reports, difference data, operational metadata, or other content added to notification files. It can also cause integrity and availability problems by delivering alerts to the wrong person while the intended recipient remains unaware of relevant updates. This finding does not expose a secret credential and does not establish that the named account is malicious; the risk arises because the recipient is fixed and not tied to user authorization. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the fixed WeCom identity from operational examples. 2. Obtain the destination from a trusted, deployment-specific configuration value. 3. Resolve the requesting user's identity through an authenticated mapping rather than free-form model output. 4. Display the resolved channel and recipient and require confirmation before the first transmission. 5. Enforce an allowlist of approved recipients at the message gateway. 6. Log the requester, confirmed destination, timestamp, and message identifier for auditability without logging sensitive message contents unnecessarily. 7. Use an unmistakable placeholder such as `<CONFIRMED_WECOM_RECIPIENT>` in documentation so examples cannot be copied as functional fixed routing instructions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directs use of privileged and system-wide storage locations such as /root, /var/log, and /tmp for automated monitoring outputs, but does not clearly warn the user that running the workflow writes files to disk and persists potentially sensitive monitoring data. This can cause unanticipated data retention, exposure to other local users or processes, and operation with unnecessary privileges.

Session Persistence

Medium

• Category: Rogue Agent

Content

系统已配置每天早上9:00自动运行：
```bash
# 查看当前定时任务
crontab -l

# 输出示例：
# 0 9 * * * /root/monitoring/securities/scripts/crawl_all.sh >> /var/log/securities/cron.log 2>&1

• Confidence: 87% confidence
• Finding: The skill states that the system is already configured to run daily via cron, indicating persistent scheduled execution beyond the current session. Persistence itself is not inherently malicious here, but it is security-relevant because it creates ongoing automated activity and recurring access to network, filesystem, and logs without emphasizing consent or lifecycle controls.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill offers to send detected updates through Enterprise WeChat without clearly warning that monitored page content and change summaries may be transmitted to an external messaging platform. Even if the monitored pages are public, notifications may contain aggregated or contextualized information that users do not expect to leave the local environment.

Session Persistence

Medium

• Category: Rogue Agent

Content

如遇问题，请检查：
1. 执行日志：`/var/log/securities/cron.log`
2. 定时任务：`crontab -l`
3. 通知文件：`ls -la /tmp/securities_*.txt`

---

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This markdown file instructs the agent/user to send messages through the `message` tool to the `wecom` channel, which transmits content to an external system. The description provides usage details and recipient examples but does not include any warning about privacy, recipient verification, or disclosure that message contents will leave the local environment.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 修改定时任务
```bash
# 编辑crontab
crontab -e

# 常用时间表达式示例：
# 每6小时执行一次

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 修改定时任务
```bash
# 编辑crontab
crontab -e

# 常用时间表达式示例：
# 每6小时执行一次

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This markdown file includes irreversible deletion commands using `rm -rf` and `find ... -delete`, but provides no user-facing warning about the risk of accidental data loss if paths or patterns are misconfigured. For markdown files, destructive behaviors that can affect user data or system integrity should be explicitly disclosed.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The script's comments and all user-visible messages are fixed in Chinese, which can violate language/locale policy when no user opt-in or alternative locale is offered. There is no indication that the skill is region-specific or intentionally limited to Chinese-speaking users.

Natural-Language Policy Violations

Low

• Confidence: 72% confidence
• Finding: All user-facing instructions in this file are presented exclusively in Chinese, and the document does not indicate that the skill is region-specific or that users can choose another language. This may violate a language/locale policy if skills are expected not to force a specific language without opt-in or justification.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The markdown file states that the skill supports 企业微信 notifications, which implies sending monitoring content to a third-party communication platform. The README does not disclose any privacy or data-handling implications of transmitting page-change information through that channel.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The skill documentation is entirely in Chinese and does not offer an alternative language or indicate that the locale is intentionally restricted to a Chinese-speaking environment. This can violate language/locale policy when a specific language is forced without opt-in or documented justification.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The script's comments and console messages are entirely in Chinese, which imposes a specific language on users without offering an alternative or opt-in. This can violate language or locale policy where skills are expected to remain language-neutral unless the constraint is explicitly justified.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: This code changes into /root/monitoring/securities/scripts and executes another shell script, which is a safety-relevant operation in a privileged-looking location. Although the script prints status messages, it does not disclose that it will run another script from a root path or warn about any privilege or system-impact expectations.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: This shell script executes `bash crawl_all.sh`, which is a subprocess operation covered by the missing-warning rule for code files. Although there is a progress message, the script does not disclose what the crawler may do to user/system data, such as network access or potential file writes, and the visible comments are only operational labels rather than a safety warning.

Static analysis

No suspicious patterns detected.