Security audit

Gold Fundamental Analysis

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to fetch and summarize gold-market data as described, but it makes outbound requests and includes an exposed default FRED API key.

Install only if you are comfortable with the skill making outbound HTTPS requests to public financial-data services. Use your own FRED key through a controlled environment variable, avoid passing secrets on the command line, run it in an isolated environment, and treat the output as analysis support rather than financial advice.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/get_gold_fundamental_data.py:30
Finding: Hard-Coded FRED API Key Exposed in Source and Documentation
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Unpinned Dependency and Mutable Installation Sources Reduce Supply-Chain Integrity
Content: View full analysis
=2.25.0 ``` `README.md:58-61`: ```bash pip install requests git clone https://github.com/kimminhpro/gold-fundamental-analysis-skill.git cd gold-fundamental-analysis-skill python3 scripts/get_gold_fundamental_data.py ``` Equivalent unpinned installation instructions also appear in `README.vi.md:54-57`. ### Technical Analysis The dependency declaration specifies only a minimum version. Consequently, installation may resolve to any later `requests` release and to transitive dependency versions that were not part of this audit. The README further recommends installing the latest available package without using a lock file or integrity hashes. The repository installation command clones a mutable default branch rather than an immutable commit or verified release. Code obtained by future users can therefore differ from the version reviewed during this audit. No malicious, typosquatted, or unrelated package was identified: `requests` is a legitimate dependency used by the script. The issue is the absence of reproducible version and integrity controls, which increases exposure if a dependency distribution channel, maintainer account, repository account, or mutable default branch is compromised. ### Attack Path 1. A user follows the documented installation procedure at a later date. 2. The package resolver selects newer dependency or transitive-dependency versions because no exact versions or hashes are required, or the repository clone retrieves a changed default branch. 3. If one of those distribution or repository sources has been compromised, the user obtains altered code that was not included in this audit. 4. The user runs the data-fetching s ...[truncated 1003 chars]
Remediation: View remediation
``` 2. Generate a lock file that also pins all transitive dependencies. 3. Record cryptographic package hashes and install with hash verification, for example: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Use a maintained dependency-update process that tests and reviews upgrades before changing the lock file. 5. Replace mutable clone instructions with a signed release, immutable tag, or specific commit identifier. 6. Publish release checksums or signatures and document how users should verify downloaded artifacts. 7. Recommend installation inside an isolated virtual environment with only the permissions required to fetch public market data. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Tainted flow: 'params' from os.environ.get (line 74, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/get_gold_fundamental_data.py (reported line 81)May include surrounding context.
python
"sort_order": "desc", "limit": 2, } resp = requests.get(FRED_BASE, params=params, timeout=15) resp.raise_for_status() data = resp.json() obs = data.get("observations", [])

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code largely matches the core purpose of fetching gold fundamental data from macro, COT, ETF, and Fed-related sources and returning JSON. However, the declared description promises more than this script actually does: it says the agent must execute the script and then analyze the output into bullish/bearish/neutral factors, a numeric Fundamental Score, and time-horizon outlooks. None of those outputs are produced by this code chunk. Additionally, there are notable source/behavior discrepancies: the description says Investing.com for upcoming events, while the code uses ForexFactory data via faireconomy.media; and the description says Fed RSS over a 7-day window, while the implementation uses the past 30 days. These are material description-versus-behavior mismatches, even though the overall domain (gold fundamentals) is aligned.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill requires executing a Python script that accesses network resources and potentially environment variables, but it does not declare an explicit tool/permission scope. In an agent setting, this weakens sandboxing and reviewability because the runtime may grant broader capabilities than users or orchestrators expect, increasing the risk of unintended outbound access or secret exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instruction says the agent "must produce this structured output in Vietnamese," which forces a specific language for all uses of the skill. This is a natural-language policy concern because no user opt-in or locale-specific justification is provided elsewhere in the file.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/get_gold_fundamental_data.py (reported line 34)May include surrounding context.
python
# ── Configuration ────────────────────────────────────────────── FRED_API_KEY = os.environ.get("FRED_API_KEY", "01fa16f50b07eb27740820fd1cdecf50") FRED_BASE = "https://api.stlouisfed.org/fred/series/observations" CFTC_URL = "https://www.cftc.gov/dea/newcot/f_disagg.txt" FED_RSS_URL = "https://www.federalreserve.gov/feeds/press_monetary.xml" SSGA_GLD_URL = "https://www.ssga.com/us/en/intermediary/etfs/spdr-gold-shares-gld"

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README explicitly describes fetching data from multiple external services but does not warn users that running the skill will make outbound network requests and may transmit metadata such as IP address, timing, and possibly API credentials to third parties. In an agent/cron-job context, this matters because execution may be automated and non-interactive, so operators may not realize the skill continuously contacts external domains or relies on third-party data sources.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The dependency is specified as requests>=2.25.0, which allows installation of many future and historical versions without reproducibility or security guarantees. In a skill that fetches remote market and Fed/CFTC/ETF data over the network, leaving a core HTTP client unpinned increases the chance of pulling a vulnerable or behavior-changing release during deployment.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.25.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: Because requests is unpinned, the manifest does not prove that deployed environments will avoid versions affected by known advisories. This skill's purpose is to retrieve external data from multiple internet sources, so issues in HTTP handling, redirects, TLS/session behavior, or credential discovery could be relevant if the environment uses .netrc, proxies, redirects, or attacker-controlled URLs/feed content.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The function docstring states it parses the Fed monetary policy RSS feed for the last 7 days, but the code computes thirty_days_ago and includes items from the past 30 days. This is an active contradiction between the inline intent documentation and the implemented behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest and module header say the skill fetches upcoming events from Investing.com, but the actual implementation fetches economic calendar data from faireconomy.media/ForexFactory JSON instead. This is a semantic mismatch in the skill's declared behavior, even though the overall purpose remains gold fundamental data collection.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.