T08 · Insecure Dependencies
Error
- Location
SKILL.md:47- Finding
Unpinned Third-Party CLI Executes with Access to an API Token
- Content
View full analysis
- Remediation
View remediation
Security audit
虾皮A股涨跌停股分析
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Chinese-language stock analysis helper, but it asks users or agents to run a mutable third-party CLI with an API token, which needs review before installation.
Install only if you trust the DAXIAPI CLI source and are comfortable giving it a token. Prefer a pinned, reviewed CLI version, avoid commands that print the token, keep the token out of shell history and logs, and rotate the token if it has already been used with an unreviewed latest package.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (17)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- ### 方式三：.env 文件 在项目根目录创建 `.env` 文件：
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to execute
npx daxiapi-cli@latest, which fetches and runs the newest package version at execution time rather than a fixed, reviewed release. This creates a supply-chain risk: if the package is compromised or a breaking/malicious release is published, the agent could execute attacker-controlled code while handling credentials or local environment access.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
This command tells the agent to run
npx daxiapi-cli@latest config set token ..., again pulling whatever version is current at runtime. Because this step handles a sensitive API token, a compromised upstream package could exfiltrate the token or abuse it, making the unpinned dependency especially dangerous in this context.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The verification step runs
npx daxiapi-cli@latest zdt --type zt, which still allows execution of an unreviewed newest release at runtime. Although this invocation is less sensitive than token setup, it remains a supply-chain execution risk because the fetched package code runs locally and could perform unintended actions.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
This duplicate finding at the same line corresponds to another unpinned
npx daxiapi-cli@latestinvocation in the same recovery instruction block. Even in documentation, normalizing runtime download-and-execute behavior for a credentialed CLI meaningfully increases the likelihood of supply-chain compromise if the package or publishing account is ever hijacked.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The documentation instructs users to run
npx daxiapi-cli@latest, which resolves and executes whatever package version is current at invocation time rather than a reviewed, fixed version. If the package is compromised, typo-squatted, or a malicious update is published, users of this skill could execute untrusted code on their systems.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
This command uses
npx ...@latest, causing runtime installation and execution of the newest published package without pinning. That creates a supply-chain risk: a malicious or compromised release would be executed directly by users following the documentation.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The skill documentation again recommends
npx daxiapi-cli@latest, which delegates trust to the current registry state at execution time. In a security context this is dangerous because users may unknowingly run attacker-controlled code if the package or publisher account is compromised.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
Even in the combined-query example, the docs tell users to invoke
npx ...@latest, preserving the same unpinned dependency execution risk. Becausenpxfetches and runs code, an upstream compromise could lead to arbitrary code execution on analyst or trader workstations.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
This second combined-query command repeats the unsafe
@latestpattern, meaning the risk is not isolated but systemic across the documentation. Repetition increases exposure because users are more likely to copy-paste and execute the commands without scrutiny.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
Although shown as an invalid-parameter example, the command still uses
npx daxiapi-cli@latest, so users copying it would execute an unpinned package before seeing the parameter validation behavior. The context is slightly less dangerous because it is illustrative error handling, but the same supply-chain execution risk remains.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file contains user-facing instructions only in Chinese, and there is no indication that the skill is region-specific or that users may choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file presents all primary instructions and field descriptions in Chinese, with no indication that the user can choose another language or that the document is intentionally limited to a Chinese-speaking audience. Under the policy rule for natural-language violations, forcing a specific language without opt-in is reportable.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document title and instructions are entirely in Chinese, with no indication that language selection is optional or that the skill is intentionally region-specific. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.