Infoway Financial API — Real-Time Quotes, Klines & Analysis

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:13 AM UTC
• Version: 0.1.2

Overview

This skill is a coherent market-data connector that uses an Infoway API key to fetch financial data, with ordinary install and third-party data-sharing cautions.

Install only if you are comfortable sending market-data queries and your Infoway API key to the Infoway service. Prefer pinning a reviewed package version or using a locked environment before connecting it to an MCP client, and avoid using it for confidential trading strategies or non-public financial information unless Infoway's data-handling terms meet your needs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: pyproject.toml:13

Finding

Unbounded Third-Party Dependency Resolution Creates a Supply-Chain Execution Risk

Content

View full analysis

Vulnerability Details

File Location: pyproject.toml:1-3, 13
Vulnerability Type: Unbounded third-party package versions
Risk Level: Medium

Vulnerable Code

toml

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

toml

dependencies = ["mcp>=1.0", "infoway-sdk>=0.1.0"]

Technical Analysis

The project does not constrain its build dependency to a reviewed version, while its runtime dependencies use only minimum-version constraints. Consequently, a fresh pip install or the documented uvx infoway-mcp-server invocation may resolve and execute dependency versions published after this project was audited.

Python build backends and package installation processes execute code with the privileges of the installing user. The runtime application also imports and invokes the resolved packages:

python

from mcp.server import Server
from mcp.server.stdio import stdio_server
from mcp.types import Tool, TextContent

from infoway import InfowayClient

This is not evidence that the currently named packages are malicious. It is a supply-chain control weakness: compromise of a dependency publisher account, malicious future release, or upstream package takeover could change the code installed and executed without requiring any modification to this repository.

Attack Path

1. An attacker compromises the publishing channel or maintainer account of hatchling, mcp, infoway-sdk, or a transitive dependency.
2. The attacker publishes a malicious version satisfying the unconstrained requirement or the relevant >= lower bound.
3. A user performs a fresh installation using pip or launches the package through the documented uvx command.
4. The package resolver selects the new malicious release because no reviewed upper bound, lock file, or hash constraint prevents it.
5. Malicious build or import-time code executes with the privileges of the ...[truncated 882 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin direct runtime and build dependencies to exact, reviewed versions rather than unconstrained or minimum-only specifications.
2. Maintain a lock or constraints file that also records resolved transitive dependency versions.
3. Use hash-verified installation, such as pip install --require-hashes -r requirements.txt, for reproducible deployments.
4. Separate broad compatibility declarations used for library publication from a fully pinned constraints file used for MCP server deployment.
5. Configure automated dependency scanning and update tooling, but require review and testing before accepting new versions.
6. Generate and retain a software bill of materials for releases and verify packages against trusted package indexes.
7. Avoid installing or running the server with elevated privileges. Execute it under a dedicated, least-privileged account with access only to the required API credential.
8. Pin the package version in documented uvx examples so routine launches do not silently adopt a newly published release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 7)May include surrounding context.

text

dist/
build/
.venv/
.env
*.egg

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to run the MCP server via uvx infoway-mcp-server without pinning an exact version. That allows future package updates to change the executed code unexpectedly, creating a supply-chain risk where users may install a compromised or breaking release with the same command.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This second uvx infoway-mcp-server example in the Chinese section repeats the same unpinned execution pattern. Unpinned MCP server installation/execution is especially risky because users are being told to run code locally inside an AI integration context, so a malicious future release could gain access to local environment variables and user prompts.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 76% confidence

Finding

The skill exposes sensitive capability through an environment variable API key but does not declare any explicit tool scope or permissions boundaries. In MCP/agent contexts, missing scope declarations can lead to over-broad access assumptions and make it harder for users or hosting systems to understand what the skill is allowed to do with provided secrets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The server forwards user-supplied query parameters such as symbols, markets, and related financial lookup inputs to the third-party Infoway API, but the tool descriptions and runtime behavior do not clearly disclose that this data leaves the local MCP environment. In MCP contexts, users may assume tools are local unless told otherwise, so undisclosed transmission can create privacy, compliance, or policy issues, especially if queries reveal sensitive watchlists, strategies, or proprietary interests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README explains that the server uses an external API and requires an API key, but it does not clearly warn users that their requests, symbol queries, and possibly analysis context will be transmitted to a third-party service. In a financial-data assistant, this matters because user interests, watchlists, and research activity can be sensitive even if no obviously secret data is involved.

Content

No source excerpt is available for this finding.

Rp1

Low

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The README also recommends pip install infoway-mcp-server without a version constraint. While common, this still exposes users to dependency confusion or malicious/unsafe future releases, and in an MCP server context that can lead to execution of altered code on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Low

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

This duplicated pip install command in the Chinese section has the same supply-chain exposure as the English example. Because the skill is for real-time financial data and requires an API key, compromised package updates could affect confidentiality of credentials and queried data in addition to integrity of the local environment.

Content

No source excerpt is available for this finding.

Rp1

Low

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Installing an unpinned package allows whatever version is current at install time to be pulled from the package index, creating supply-chain risk from malicious updates, compromised maintainers, or breaking changes. Because this package runs as an MCP server and receives an API key, a hostile or compromised release could exfiltrate credentials or manipulate financial data responses.

Content

No source excerpt is available for this finding.

Rp1

Low

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The installation example again references an unpinned package version, which reproduces the same supply-chain exposure for anyone following the configuration instructions. Since the server is intended to handle authenticated market-data requests, compromise of the package could affect both secret handling and integrity of returned financial information.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: mcp has 12 known advisory(ies) (CVE-2025-53366 (MCP Python SDK vulnerability in the FastMCP Server causes validation error, lead); CVE-2025-66416 (Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection); CVE-2026-52870 (MCP Python SDK: Experimental task handlers allow any client to access and cancel) +9 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 82% confidence

Finding

The manifest declares mcp>=1.0 without an upper bound or exact pin, while the dependency family has multiple published advisories. Because any future compatible but vulnerable version may be installed, consumers of this skill can unknowingly inherit server-side flaws such as request validation weaknesses, DNS rebinding exposure, or authorization issues in MCP components.

Content

No source excerpt is available for this finding.

Rp1

Low

• Category: MCP Rug Pull
• Confidence: 60% confidence

Finding

pip install without ==version installs the latest release, which could include malicious changes.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · src/infoway_mcp_server/server.py (reported line 38)May include surrounding context.

python

f"Invalid market_type '{market_type}'. "
            f"Must be one of: {', '.join(sorted(_MARKET_CLIENTS))}"
        )
    return getattr(client, mt)


# ---------------------------------------------------------------------------

Static analysis

No suspicious patterns detected.