T09 · Insecure Skill Coding Practices
Warning
- Location
mx_select_stock.py:223- Finding
Unsanitized API Data Enables CSV Formula Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
Mx Select Stock
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent stock-screening API tool, with expected network use and local result files, but users should treat generated CSV data as untrusted.
Install only if you are comfortable sending stock-screening query text to Eastmoney's Miaoxiang API using MX_APIKEY. Keep sensitive information out of queries, review the output directory for retained CSV/description/raw JSON files, and open generated CSVs with spreadsheet formula execution disabled or after sanitizing untrusted values.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises capabilities that involve environment-variable access, network access, and local file writes, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent may invoke broader capabilities than a user expects, increasing the risk of unintended data access, external requests, or filesystem modification.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
The skill sends the user-provided query and an API key to an external third-party endpoint. While external API access is expected for this skill's purpose, it still creates a real data exposure risk because any sensitive information embedded in the query will be transmitted outside the local environment and persisted in returned/output files.
- Content
python "keyword": query } response = requests.post(self.BASE_URL, headers=headers, json=data, timeout=30) response.raise_for_status() return response.json()
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The skill states that it will automatically create an output directory and write result files, but it does not clearly warn users about the local side effects or give them control over whether persistence occurs. While the described writes appear related to normal functionality, undisclosed automatic filesystem changes can leak sensitive query content into local storage and surprise downstream users or agents.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file’s natural-language descriptions and examples are entirely in Chinese, including the skill name and usage guidance, with no indication that another language is supported or that the user may choose their preferred language. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.