AIGroup Market MCP

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:18 AM UTC
• Version: 0.1.3

Overview

The skill is a coherent China-market data integration, but it runs an unpinned npm MCP server with a service token and allows automatic invocation, so users should review it before installing.

Install only if you are comfortable running the external MCP package. Prefer pinning `aigroup-market-mcp` to a reviewed version, limiting the environment passed to the process to the minimum needed token, rotating TUSHARE_TOKEN if exposed, and requiring explicit approval before automatic MCP invocation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:32

Finding

Unpinned Third-Party MCP Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32-36; duplicated in references/capabilities.md, lines 38-42
Vulnerability Type: Unpinned and automatically executed third-party dependency
Risk Level: High

Vulnerable Code

markdown

## Dependency

- Server name: `aigroup-market-mcp`
- Launch pattern: `npx -y aigroup-market-mcp`
- Required environment variable: `TUSHARE_TOKEN`

The same launch pattern is documented in references/capabilities.md:

markdown

## Dependency

- MCP server name: `aigroup-market-mcp`
- Local launch pattern in this workspace: `npx -y aigroup-market-mcp`
- Required environment variable in this workspace: `TUSHARE_TOKEN`

Technical Analysis

The command npx -y aigroup-market-mcp does not specify an exact package version or integrity hash. Depending on the local npm cache and configuration, npx can retrieve the current package release from the configured npm registry and immediately execute it. The -y option suppresses the installation confirmation prompt.

Consequently, the code executed at runtime can differ from the code that was available when this Skill was reviewed. The package is also expected to run in an environment containing TUSHARE_TOKEN, giving its executable code access to that credential. The repository does not include the dependency source, a lockfile, an integrity value, or another mechanism that would make the executed artifact reproducible and independently verifiable.

The configuration in agents/openai.yaml additionally permits implicit invocation:

yaml

policy:
  allow_implicit_invocation: true

This can reduce the degree of explicit user awareness before the external MCP dependency is used, although it does not independently establish malicious behavior.

Attack Path

1. An attacker compromises the npm package, its publisher account, the package distribution process, or a configured package regis ...[truncated 1425 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed exact version, such as aigroup-market-mcp@X.Y.Z, rather than resolving the latest available release.
2. Record and verify the package integrity hash through a committed lockfile or equivalent reproducible dependency manifest.
3. Remove -y where interactive approval is appropriate, particularly for first-time installation or dependency changes.
4. Prefer a controlled installation step followed by execution from a verified local dependency tree instead of downloading and executing a package during Skill invocation.
5. Verify and document the expected npm publisher, repository, package provenance, and release-signing information.
6. Run the MCP server in a sandbox or container with a read-only filesystem where possible, restricted outbound network access, and no access to unrelated host files.
7. Pass only TUSHARE_TOKEN to the process rather than the full parent environment, and ensure that the token has the minimum required permissions and can be rotated promptly.
8. Consider disabling implicit invocation for operations that can start externally sourced executable code, requiring explicit user approval before launch.
9. Add automated dependency monitoring and require security review before updating the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to launch an MCP server via npx -y aigroup-market-mcp without pinning a specific package version or integrity hash. This causes each installation/run to trust the current registry state, so a compromised maintainer account, malicious new release, dependency hijack, or typo-squatted replacement could result in arbitrary code execution on the host, especially since the tool is expected to run with access to market data workflows and the TUSHARE_TOKEN environment variable.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill enables allow_implicit_invocation without any trigger constraints, exclusions, or user-confirmation guardrails. That means the agent may invoke the external MCP data server automatically based on broad relevance, which can cause unintended tool use, unnecessary disclosure of user queries to the tool, or overreach into financial-data operations without explicit consent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The document instructs launching an MCP server via npx -y aigroup-market-mcp without pinning a specific package version. This makes execution depend on whatever version is current in the registry at runtime, increasing supply-chain risk from malicious package updates, account compromise, or unexpected breaking changes. In this skill context, the command is especially sensitive because it launches a tool that can access market data and relies on an environment variable token, so users may execute it in a trusted workflow without reviewing what version is being installed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language description and default prompt direct use specifically for China-market data. While a regional focus may be valid, the file does not indicate user choice, opt-in, or a documented justification for enforcing that locale/market scope.

Content

No source excerpt is available for this finding.