Security audit

qieman-mcp

Security checks across malware telemetry and agentic risk

Overview

This finance-data skill is coherent overall, but its setup flow gives the agent too much control over login, SMS verification, personal profile collection, and API-key storage.

Review carefully before installing. Use it only if you trust Qieman and qieman-mcp-cli, and prefer to complete login, SMS verification, agreement acceptance, and API-key copying yourself outside the agent. Do not share SMS codes or raw API keys in chat unless you accept the risk, and avoid sending detailed household or financial data unless you intend it to be processed by the service.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The workflow directs the agent to perform full account onboarding and authentication activities—collecting a phone number, handling SMS verification, determining account status, and gathering profile details—to obtain access credentials. This materially exceeds the skill's stated purpose of financial data retrieval and analysis, and turns the skill into an account access and credential provisioning flow. In the context of an agent skill, that expansion of scope is dangerous because it normalizes sensitive identity and login handling by the agent and creates opportunities for credential theft, overcollection of personal data, and unauthorized account actions.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The workflow explicitly instructs the agent to visit a logout URL and clear the current login state before proceeding. For a finance-data skill, manipulating account session state is not necessary for querying funds, strategies, notices, or generating analytics, and it can disrupt the user's active session or alter account context without a clear security justification. In agent environments, such unnecessary account-state changes increase the risk of unintended side effects and can be combined with later login automation to take over the full authentication flow.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The activation description is very broad and says the skill should be preferred for many common finance-related tasks, which can cause the agent to invoke this skill in situations where narrower, safer, or more appropriate tools should be considered first. In a finance context, over-triggering is risky because the skill exposes real data access and executable capabilities, increasing the chance of unnecessary external calls, unintended data disclosure, or over-reliance on a third-party service.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The skill content is effectively Chinese-only and does not offer a language-choice mechanism, which can cause the agent to change language behavior without user consent or fail to communicate limitations clearly. While this is not a direct code-execution issue, it can create unsafe UX in financial workflows by increasing misunderstanding of tool outputs, parameters, or risk disclosures.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The instructions tell the agent to read, copy, and write an API key into local CLI configuration, but provide no warning that the key is a sensitive credential or that storing it locally may persist access beyond the current task. That omission can mislead users into handing over long-lived credentials without understanding the risk of leakage, reuse, or later compromise from local files, logs, shell history, or other tooling. In a skill that accesses real financial data and operations, silent credential handling is particularly risky.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The workflow collects a phone number, SMS verification code, and personal profile details such as name, organization, role, and optional email, but does not clearly warn users that these are sensitive data elements or explain how they will be used, stored, or protected. This creates a privacy and social-engineering risk because users may disclose authentication factors and personal information to an agent without informed consent. The danger is heightened here because the data is gathered for account creation/access rather than the skill's advertised finance-analysis function.

Ssd 3

High

Confidence: 99% confidence
Finding: The workflow instructs the agent to retrieve the user's API key from a web account page, copy it, and store it locally for later use. This is direct credential extraction and persistence by the agent, which creates a high risk of unauthorized reuse, exfiltration through prompts/logs/history, and access that may outlive the user's intent. Because the key appears to grant access to a real financial-data service, compromise could expose sensitive account-linked data or enable abusive use of the service under the user's identity.

Ssd 3

High

Confidence: 99% confidence
Finding: The login flow asks the agent to request the user's phone number and SMS verification code and then enter them during authentication. This means the agent is handling both identity information and a one-time authentication factor, which is equivalent to mediating account login and can facilitate account takeover, phishing-style credential harvesting, and unauthorized access if mishandled. In the context of a finance-related skill, handling login secrets is especially dangerous because it may bridge directly to sensitive personal and financial data.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.