T08 · Insecure Dependencies
Warning
- Location
SKILL.md:65- Finding
Unpinned and Unnecessary Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
Quant Trading Api
Security checks for vulnerabilities and agentic risk
Overview
This skill presents itself as a real Chinese securities trading integration, but the bundled implementation is a simulator that accepts broker credentials and returns fabricated trading results.
Review this carefully before installing. Treat it as simulation code only unless the publisher clearly documents and implements real broker authentication, paper/live separation, credential handling, order confirmation, risk limits, and authoritative broker reconciliation. Do not provide production broker credentials to this version.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Error
- Location
quant_trading.py:69- Finding
Live Trading Functionality Is Misrepresented by a Mock Implementation
- Content
View full analysis
Dict: """Login to broker""" # In production, would call actual broker API # This is a mock implementation self._token = f"token_{int(time.time())}" self.account_info = { 'account_id': self.account, 'account_name': 'Test Account', 'total_assets': 1000000.0, 'available': 800000.0, 'market_value': 200000.0, 'margin': 0, 'status': 'normal' } print(f"Logged in to {self.config['name']}") return {'success': True, 'token': self._token} ``` Order placement also marks an order as filled only in local memory: ```python self.orders.append(order) # Simulate order fill (in production, would wait for async callback) self._simulate_fill(order_id) return order ``` ```python def _simulate_fill(self, order_id: str): """Simulate order fill""" # In production, would use async callbacks for order in self.orders: if order['order_id'] == order_id: order['status'] = 'filled' order['filled'] = order['volume'] break ``` This conflicts with claims in `SKILL.md` that the package provides full broker APIs, real-time market data, order lifecycle management, scheduled execution, and automated risk controls. ### Technical Analysis The package behaves as an in-memory trading simulator rather than a live broker integration: - `login()` accepts an account and password but does not authenticate with a broker. - A predictable local token is generated from the current Unix timestamp. - Account balances and status values are hard-coded. - Market prices, volumes, and order books are generated locally. - Orders are immediately cha ...[truncated 2367 chars]- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documentation claims real broker integration, real-time data, and live order execution, but the analyzed behavior indicates mock or synthetic implementations instead of actual authenticated broker connectivity. In a financial-trading context, this is dangerous because users may make trading, risk, or deployment decisions based on false assumptions about execution, account state, and market data, potentially causing direct financial loss or unsafe automation.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The strategy code can place buy and sell orders automatically during runtime without any confirmation, approval gate, risk limit, or explicit dry-run safeguard. In a trading skill, this is especially dangerous because erroneous strategy logic, bad data, or misuse can trigger immediate financial transactions and losses.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill documents capabilities that inherently require network access and likely credentials handling, but it does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, missing scope declarations can cause reviewers and users to underestimate what the skill may access, reducing transparency and increasing the chance of unsafe execution with network or environment data exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill describes placing buy/sell orders and managing orders without an explicit warning that such actions may be irreversible and can affect real assets. In a trading context, omission of this warning increases the chance that users treat examples as safe defaults and trigger unintended financial transactions or losses.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The automated strategy, scheduled order, stop loss, and take profit sections encourage unattended execution without clearly warning that automation can trade continuously or at specific times without further review. In a financial system, unattended execution can amplify mistakes, strategy bugs, stale data issues, or misconfiguration into repeated asset-impacting actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The module description and class docstrings frame the skill as specifically for Chinese brokers, and the implementation hardcodes Chinese broker names, A-share trading hours, and Chinese stock labels. There is no natural-language indication that users can choose another locale or that the locale restriction is intentionally documented as a region-specific tool.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code claims to be a mock implementation, but the constructor still ingests real broker credentials from environment variables. This can mislead users into providing production secrets to code they may assume is non-sensitive test code, increasing the risk of accidental credential exposure, misuse, or later extension into real networked behavior.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest explicitly scopes broker support to 华泰, 银河, 广发, and 中信建投. The BROKERS table additionally declares 'tonghuashun' with a Tushare API endpoint, extending beyond the described broker set and mixing a market-data provider into broker integration scope.
- Content