Security audit

finance-reporter

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently fetches public market data from Yahoo Finance and prints a Chinese finance report, with some install and localization caveats but no evidence of hidden, destructive, or deceptive behavior.

Before installing, be aware that the skill is Chinese-oriented, needs outbound access to Yahoo Finance, and may be scheduled to run if you explicitly add the documented cron job. Prefer installing Python dependencies from a pinned requirements file instead of the current unpinned requests command.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: package.json:32
Finding: Unpinned and Inconsistently Declared Third-Party Dependency
Content: View full analysis
Remediation: View remediation
``` 3. Generate and retain hashes for reproducible installation where practical: ```text requests== \ --hash=sha256: ``` Install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Use a dependency lock workflow such as `pip-tools`, Poetry, or uv so direct and transitive dependencies are fixed and reviewable. 5. Update `SKILL.md` to instruct users to install from the reviewed dependency file: ```bash python3 -m pip install -r requirements.txt ``` 6. Configure installation to use the official or an organization-approved Python package index over HTTPS. Review dependency provenance and run automated vulnerability scanning before updating locked versions. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The user-facing documentation is written entirely in Chinese, including the skill description and feature list, with no indication that other languages are supported or that Chinese is a required locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill explicitly relies on external network access to Yahoo Finance API and webhook-style push integrations, but it does not declare any tool scope such as permissions or allowed-tools. Undeclared network capability weakens least-privilege controls and can allow broader outbound access than reviewers or operators expect, increasing the risk of data exfiltration or misuse if the implementation changes or is compromised.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file’s natural-language description, instructions, and examples are entirely in Chinese, including the manifest description and user invocation guidance. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description is entirely in Chinese and does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. This creates a natural-language locale policy concern because it implicitly fixes the skill's presentation language without user opt-in or justification.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · package.json (reported line 33)May include surrounding context.
json
"python": ">=3.8" }, "dependencies": { "requests": "^2.28.0" } }

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This Python file contains natural-language descriptions and user-facing report text exclusively in Chinese, including the module docstring and generated output labels. Under the policy rule for language/locale, this can be a violation when a specific language is forced without user opt-in or an explicit documented justification.
Content: No source excerpt is available for this finding.