T09 · Insecure Skill Coding Practices
Error
- Location
scripts/12可转债自定义因子纯轮动系统.py:166- Finding
Unauthenticated remote factor data can directly influence live securities orders
- Content
View full analysis
- Remediation
View remediation
Security audit
小果全能大QMT量化交易助手
Security checks for vulnerabilities and agentic risk
Overview
This QMT trading assistant openly includes live-trading code, but some bundled scripts can automatically place real orders and handle authorization values unsafely.
Review the scripts before installing or running them in QMT. Use simulation first, remove plaintext HTTP endpoints and credential logging, replace hardcoded/shared authorization values, and add explicit live-trading controls such as account allowlists, order limits, and a kill switch before connecting a real brokerage account.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/12可转债自定义因子纯轮动系统.py:50- Finding
Hardcoded authorization values are transmitted and logged over plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/10法码动态定投实盘策略代码版.py:661- Finding
Membership verification helpers place usernames and passwords in HTTP query strings and logs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (518)
Ssd 3
Critical
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The runtime messages explicitly print username, password, and authorization code in plaintext. In a trading environment this is extremely dangerous because secrets can be harvested immediately from terminal history, logs, remote support captures, or centralized observability systems.
- Content
Missing User Warnings
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script can place live buy and sell orders through passorder() based only on internal strategy conditions, with no interactive confirmation, kill switch, or runtime safeguard at the execution point. Because this skill is explicitly designed for real-money QMT trading, automatic execution materially increases the risk of unintended orders, rapid losses, and abuse if the strategy or environment is misconfigured.
- Content
Context-Inappropriate Capability
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The validation function transmits username, password, and invite code to an external HTTP endpoint, which is a severe credential-exfiltration risk. This is especially dangerous in a trading assistant because users may reuse credentials or assume the script only performs local quantitative-strategy logic, not remote collection of sensitive data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented behavior materially exceeds the declared role of a code-generation/help assistant by including direct real-trading execution, account inspection, and operational order management. This mismatch is dangerous because users may invoke what appears to be advisory functionality while actually enabling actions with financial impact and access to sensitive brokerage state.
- Content