T08 · Insecure Dependencies
Error
- Location
SKILL.md:260- Finding
Unpinned npm Package Execution with Access to API Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
大虾皮股市工具集
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent A-share market data helper, but it tells users to run mutable npm code with API credentials and handles tokens in ways that could expose them.
Review this skill before installing. Use a pinned and trusted `daxiapi-cli` version instead of `@latest`, avoid pasting real tokens into command lines or chats, assume token-check output may be logged, and treat all market or stock guidance as informational rather than financial advice.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:252- Finding
Plaintext API Token Disclosure Through Configuration Inspection
- Content
View full analysis
` | 设置配置项 | `daxiapi config set token YOUR_TOKEN` | | `config get` | 查看所有配置 | `daxiapi config get` | | `config delete ` | 删除配置项 | `daxiapi config delete token` | ``` The token-specific inspection command is repeated at `SKILL.md:341-350`. ### Technical Analysis The documented authentication check retrieves the token value rather than checking whether a valid token exists. If the CLI prints the configured value, the secret becomes part of standard output. Agent command output may be captured in conversation history, build logs, shell transcripts, debugging records, telemetry, or execution traces. Consequently, a token that was initially protected in configuration can be exposed to systems and users that only have access to logs. The Skill does not need the plaintext token to determine whether authentication is configured. A masked status or an authenticated health check would satisfy the declared functionality with less exposure. ### Attack Path 1. A user has previously configured a valid DaxiAPI token. 2. The Skill follows its token-check workflow and runs `config get token` or the broader `config get`. 3. The CLI prints the token in plaintext. 4. The agent platform, terminal logger, CI system, or monitoring service stores the output. 5. An attacker or unauthorized operator with access to those records retrieves the token. 6. The attacker reuses it against the authenticated DaxiAPI service until the token expires or is revoked. ### Impact Assessment ...[truncated 464 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
references/api-reference.md:1029- Finding
Hardcoded Third-Party API Tokens Embedded in Request URLs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (13)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill provides step-by-step token acquisition and configuration instructions, including placing the secret directly on the command line and in environment variables, but it does not warn that the token is sensitive. In practice, this can lead users to expose credentials through shell history, screenshots, logs, terminal sharing, or accidental paste into chats, which is especially relevant because the skill centers on authenticated financial-data access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document provides explicit valuation-temperature thresholds and corresponding actions such as increasing fixed investment or considering profit-taking, which amounts to actionable investment guidance. Without a clear disclaimer that outputs are informational only and not financial advice, downstream agents may present these thresholds as recommendations, increasing the risk of unsuitable or harmful financial decisions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The usage scenarios explicitly frame the API as supporting stock selection, DCA timing,涨跌停 analysis, and technical-pattern screening, all of which can directly influence trading behavior. In the context of an agent skill that routes user requests into specialized market-analysis tools, the absence of a matching risk warning makes it more likely that users receive operational investment suggestions without appropriate caution.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The documentation instructs users to run
npx daxiapi-cli@latest, which fetches and executes the latest published package version at runtime. This creates a supply-chain risk: a compromised publisher account, malicious release, or breaking update could cause arbitrary code execution on the user's machine when they follow the example.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
This example again uses
npx daxiapi-cli@latest, causing execution of whatever version is current in the registry at the time the command is run. In an agent skill or documentation context, copy-pasteable unpinned execution commands materially increase the chance of users running unreviewed or malicious code.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The command example on this line also relies on
npxwith@latest, exposing users to registry-side package substitution or malicious future updates. Because the file is intended as a reference guide, these examples may be routinely reused, amplifying the operational risk of unpinned remote code execution.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
All headings, field descriptions, guidance, and examples are presented in Chinese, and the file does not indicate that the skill is China-only or otherwise intentionally restricted to Chinese-language users. Per the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This file presents all user-facing instructions and field descriptions only in Chinese, with no indication that the user can opt into another language or that the skill is intentionally region-specific.
- Content