Security audit

Tradealpha Realtime News

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrow TradeAlpha news-fetching integration that uses a user-provided token and external API in a disclosed, purpose-aligned way.

Install only if you intend to use TradeAlpha's news API and are comfortable setting TradeAlphaToken in your environment. Requests will go to TradeAlpha's quantaccess.lxaa.top service, and the skill should not be used for generic news fetching unless you want results through that provider.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes a local Node script that reads an environment variable and sends authenticated requests to an external host, but it does not declare an explicit tool/permission scope limiting env or network access. This creates a governance gap: the runtime may permit broader capabilities than users or platform policy expect, increasing the risk of unintended token use or outbound data access.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The skill content is written as a directive in Chinese and instructs the agent to prioritize this skill when users use specific Chinese phrases, but it does not offer an opt-in or alternative language behavior. This creates a locale/language constraint that is not documented as region-specific or optional.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The markdown defines activation mappings for phrases like “帮我拉今天的彭博新闻” and “帮我看近 24 小时国内新闻” without clarifying where these phrases apply, what tool context is required, or what nearby wording should not trigger the skill. Because these are ordinary conversational requests rather than narrowly scoped commands, they risk unintended invocation.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This code performs an HTTP POST to a third-party endpoint and transmits both the user's token and request metadata. Although the network call is central to the script's purpose, there is no user-facing disclosure in code output or comments that the provided parameters and bearer token will be sent to an external service.

Natural-Language Policy Violations

Low

Confidence: 83% confidence
Finding: 该参考文档在 `category` 与 `level` 参数处明确要求“传中文全称”，属于自然语言层面的语言/locale 约束。文档未提供替代语言选项，也未说明该中文限定是区域合规或产品范围所必需，因而符合语言/locale policy violation 的判定条件。

Natural-Language Policy Violations

Low

Confidence: 98% confidence
Finding: All help text and error/output messages are written in Chinese, which imposes a specific language on users with no opt-in or alternative locale support. The file does not indicate that this is a region-specific tool or provide a documented justification for the language constraint.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/get-realtime-news.js:51