T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:37- Finding
Hardcoded Shared API Credential Used as an Automatic Fallback
- Content
View full analysis
- Remediation
View remediation
Security audit
stock
Security checks for vulnerabilities and agentic risk
Overview
This finance data skill is not destructive, but it should be reviewed because it ships a reusable API key and tells agents to use it automatically.
Review before installing. Use only your own scoped MX_APIKEY, do not rely on the bundled default key, and avoid sending confidential trading strategies, client details, account data, or proprietary research terms through this skill unless you accept that the query will be sent to the external finance API.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (26)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The document instructs users to fall back to a hard-coded default API key when no environment variable is present, effectively publishing a reusable credential in operational guidance. This encourages unauthorized/shared credential use, makes abuse and quota exhaustion likely, and can expose all downstream requests and billing/account activity tied to that key.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The public 'API Key' section explicitly displays a default key without a prominent security warning or restriction, normalizing the use of a shared secret. In a skill context that drives automated API calls, this increases the chance that agents will transmit real user queries under an exposed credential, enabling abuse, throttling, and attribution of third-party activity to the key owner.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documentation tells users to fall back to a hard-coded example API key if no environment variable is present. Shipping or encouraging use of a shared embedded credential is unsafe because it promotes unauthorized use, makes attribution impossible, and risks service abuse, revocation, or accidental dependence on someone else's secret.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
文档标题和整体说明均仅以中文呈现，且未声明这是面向特定中文用户群体的区域性技能，也未提供其他语言选项。按照语言/地区策略，若技能实际要求或默认强制特定语言而没有用户选择或合理说明，可能构成自然语言政策问题。
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
API调用方式
bash curl -X POST --location 'https://mkapi2.dfcfs.com/finskillshub/api/claw/news-search' \ --header 'Content-Type: application/json' \ --header 'apikey: {MX_APIKEY}' \ --data '{"query":"查询内容"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
API调用方式
bash curl -X POST --location 'https://mkapi2.dfcfs.com/finskillshub/api/claw/stock-screen' \ --header 'Content-Type: application/json' \ --header 'apikey: {MX_APIKEY}' \ --data '{"keyword": "选股条件", "pageNo": 1, "pageSize": 20}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
API调用方式
bash curl -X POST --location 'https://mkapi2.dfcfs.com/finskillshub/api/claw/query' \ --header 'Content-Type: application/json' \ --header 'apikey: {MX_APIKEY}' \ --data '{"toolQuery": "查询内容"}'
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
文档说明该 Skill 支持通过“自然语言”查询三类金融数据，但没有列出明确的触发短语、适用上下文或不应触发的负例。这类描述容易与普通对话重叠，导致技能在泛化金融问答场景中被意外调用。
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The skill explicitly sends user-supplied queries and an API key to an external domain, which is a real external transmission path. In this context the transmission is expected for the feature, but it still carries security significance because potentially sensitive financial prompts and credentials leave the local trust boundary and are sent to a remote service.
- Content
使用POST请求调用以下接口：
bash curl -X POST --location 'https://mkapi2.dfcfs.com/finskillshub/api/claw/query' \ --header 'Content-Type: application/json' \ --header 'apikey: {MX_APIKEY}' \ --data '{"toolQuery": "查询内容"}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation instructs the agent to read an API key from the environment and send it to a third-party endpoint, but does not require explicit user awareness or consent for credential use. In an agent setting, this can normalize silent credential exfiltration to an external service and increases the chance that secrets are transmitted without appropriate disclosure, approval, or scoping.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This JSON manifest describes the skill as applicable to broadly phrased requests such as obtaining time-sensitive information, specific event information, policy interpretation, impact analysis, and other 'non-common-knowledge' tasks, but it does not define explicit trigger phrases, boundaries, or exclusion conditions. Such broad natural-language scope can overlap with many ordinary finance-related queries and may cause unintended invocation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions direct outbound transmission of user queries to an external endpoint and explicitly encourage use of a hardcoded fallback API key when an environment secret is absent. This creates credential-handling risk and can expose user-provided financial queries to a third party without clear consent or disclosure, increasing the chance of unauthorized key reuse, leakage, or policy violations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly sends user-supplied queries to a third-party HTTPS endpoint but does not warn that prompts may leave the local system or contain sensitive financial, personal, or proprietary information. In a finance-focused skill, queries may include confidential trading intent, account context, or internal research topics, so undisclosed transmission creates a real privacy and data-governance risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This skill is designed around sending data to an external API, so the transmission itself is expected, but it is still a genuine security-relevant behavior because user input leaves the trust boundary. In this context, the danger is elevated by the financial domain: search terms can reveal sensitive investment interests, internal analysis topics, or regulated information if users are not warned or inputs are not constrained.
- Content
使用POST请求调用以下接口：
bash curl -X POST --location 'https://mkapi2.dfcfs.com/finskillshub/api/claw/news-search' \ --header 'Content-Type: application/json' \ --header 'apikey: {MX_APIKEY}' \ --data '{"query":"查询内容"}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation advises using an API key from the environment or falling back to a shared default example key, but provides no warning about secure credential handling. Encouraging use of a default key and omitting guidance on storage, rotation, and non-disclosure can lead to credential misuse, accidental leakage, and unauthorized consumption of the external service.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Requiring the system to echo the user's full query verbatim in output can reflect sensitive data back into chat history, logs, analytics pipelines, or downstream displays. Because this skill is for financial information retrieval, user queries may contain confidential strategy details, client identifiers, or other sensitive context that should be minimized rather than repeated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This is a JSON manifest file, so vague-trigger checks apply. The instructions emphasize '基于自然语言查询进行选股' and broad examples, but do not define a narrow activation phrase, context boundary, or negative examples, which could cause the skill to be invoked for ordinary investing-related conversation rather than explicit tool use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs checking for an environment API key and, if absent, falling back to a hard-coded example API key embedded in the manifest. Bundling credentials or encouraging use of a shared default key is dangerous because it normalizes insecure secret handling, can enable unauthorized use of a third-party service, and may expose the provider or users to abuse, quota exhaustion, or attribution problems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs checking for an environment API key and, if absent, falling back to a hard-coded example API key embedded in the manifest. Bundling credentials or encouraging use of a shared default key is dangerous because it normalizes insecure secret handling, can enable unauthorized use of a third-party service, and may expose the provider or users to abuse, quota exhaustion, or attribution problems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs callers to send the user's stock-selection keyword and related parameters to a third-party HTTPS endpoint, but it does not clearly disclose that user-provided content leaves the local system and is processed externally. In an agent setting, this can expose sensitive investment intent, proprietary screening logic, or user data without informed consent or policy checks.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
This skill is explicitly designed to perform a network POST request to an external stock-screening API, so external transmission is expected in context; however, it still creates a real data-exposure boundary because the keyword and request metadata are sent off-platform. The risk is amplified because the skill targets financial analysis workflows, where queries may reveal sensitive trading interests or proprietary research criteria.
- Content
使用POST请求调用以下接口：
bash curl -X POST --location 'https://mkapi2.dfcfs.com/finskillshub/api/claw/stock-screen' \ --header 'Content-Type: application/json' \ --header 'apikey: {MX_APIKEY}' \ --data '{"keyword": "选股条件", "pageNo": 1, "pageSize": 20}'
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This manifest file says the skill supports querying financial data '通过自然语言查询' and gives examples, but it does not define explicit trigger phrases, activation boundaries, or negative examples. In systems that route skills from descriptions, this broad wording can overlap with many ordinary finance-related requests and increase unintended invocation risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The manifest description, parameter guidance, and full instruction block require Chinese-language interaction without indicating that users may choose another language. This can violate a language/locale policy when the skill is used in a multilingual environment and no opt-in or justification is provided.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The instructions repeatedly state that the skill should be used to query '金融相关数据' and support natural-language queries across multiple broad categories, but do not include exclusion criteria or scope limits. For a manifest-style instruction block, this is an ambiguous activation condition that may cause the skill to match a wide range of generic finance conversations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The description and operational instructions are entirely written to conduct the skill in Chinese and require outputs such as query summaries and result formatting in that language, without stating that users may choose another language. This can violate language/locale policy where user opt-in is required for a forced locale.
- Content