Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
baostock_tt_skills
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed China A-share data and technical-analysis helper, with no evidence of hidden persistence, credential theft, destructive behavior, or exfiltration.
Install only if you are comfortable with a Chinese-language A-share data skill that queries BaoStock and may produce technical-analysis opinions. Treat any buy/sell-style output as informational, verify data independently, and consider pinning dependencies before use.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear description-behavior mismatch. The declared purpose is data acquisition across several finance domains, but the actual code only defines mathematical/time-series utilities and technical indicator calculations. It performs no network access, database access, file ingestion, API calls, or other data retrieval logic. Its primary purpose is indicator computation, which is materially different from the declared data-fetching functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个偏数据获取型能力集合，涵盖历史K线、财务、宏观和板块成分股等多个数据源/数据类别；但该代码块的核心用途是对单只A股进行技术分析，而不是通用数据获取。它确实使用BaoStock获取了历史日K线，和声明中的“K线数据”部分一致，但没有实现季频财务数据、宏观经济数据或板块成分股查询。相反，代码新增了未声明的能力：计算MA、MACD、KDJ、RSI、BOLL，并给出综合评分和操作建议，这属于明显不同的主要功能。因此描述与实际行为存在实质性不匹配。
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Manifest 描述将技能范围限定为获取 A 股历史K线、财务、宏观和板块成分股等金融数据；但从 L310 起，文档明确声明集成 MyTT 并在用户请求时自动执行技术分析、输出评分和操作建议。这不只是对已获取数据的实现细节说明，而是新增了分析决策能力，与“数据获取”这一描述范围不一致。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger phrase for technical analysis is broad ('分析xxx的技术面') and the document states the system will automatically invoke technical-analysis behavior. In an agent setting, vague triggers can cause unintended tool use, expanded processing beyond user intent, and unreviewed generation of recommendation-like output, especially when combined with shell-access tooling and an external script path.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The function labels three distinct RSI periods, but all three fields are sourced from the same single MyTT RSI output. In a financial-analysis skill, this can materially mislead users into believing multiple independent indicators confirm a signal when they do not, degrading decision quality and trustworthiness.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script emits direct investment-style guidance such as bullish/bearish recommendations without any warning that the output is informational only and may be inaccurate or incomplete. In the context of a retail-facing financial skill, this increases the risk of users over-relying on automated output for trading decisions and suffering financial harm.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script's docstring, status messages, and all user-facing output are written in Chinese throughout the file. Because the file provides no option to select another language and no documented justification that it is a China-specific or Chinese-only skill, this is a natural-language locale policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest uses Chinese-only natural language in the description and tags, which can amount to forcing a specific language without any opt-in or documented locale restriction. There is no indication that the skill is intended only for Chinese-speaking users or that alternative language support is unavailable by design.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes the skill as retrieving A-share historical K-line, financial, macroeconomic, and constituent-stock data. Throughout the documented code examples, the skill also persists retrieved results to local filesystem paths via pandas
to_csv(...), which is a write capability not mentioned in the manifest description. While plausible as an example usage detail, it is still broader than pure data retrieval.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This plain-text documentation forces a specific language/locale experience by presenting all instructions and examples only in Chinese. The file does not offer an alternative language, user choice, or a justification that it is intended solely for a China-specific audience.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The dependency specification uses a lower-bound only constraint (baostock>=0.8.0), which makes builds non-reproducible and allows future upstream releases to be installed without review. While this file does not itself execute code, unpinned packages increase supply-chain risk and can unexpectedly introduce vulnerable or malicious versions into the environment.
- Content
text baostock>=0.8.0 pandas>=1.5.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The pandas dependency is also specified with only a minimum version (pandas>=1.5.0), so installation may resolve to any later release depending on when and where the package is installed. This weakens reproducibility and creates avoidable supply-chain exposure because unreviewed upstream changes can enter the runtime environment.
- Content
text baostock>=0.8.0 pandas>=1.5.0
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The file's natural-language descriptions are written entirely in Chinese, including the title and operational comments, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking or region-specific audience. Under the stated policy, language or locale constraints should either be optional for the user or clearly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Docstrings and all user-facing print output are fixed in Chinese, which imposes a specific language on users without opt-in. Under the policy, forcing a language or locale without offering a choice is a natural-language policy violation unless it is clearly justified as region-specific.
- Content
Static analysis
No suspicious patterns detected.