other
Warning
- Location
SOUL.md:21- Finding
Unbounded Retention of User Financial Analysis History
- Content
View full analysis
- Remediation
View remediation
Security audit
jin-duo-duo-strategy
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a disclosed stock technical-analysis tool, but it instructs the agent to remember users' financial analysis requests without clear consent, retention, or deletion controls.
Review this skill before installing if you do not want your stock analysis requests or strategy interests remembered across sessions. Use it statelessly unless the host platform provides clear memory controls, and install dependencies in an isolated environment with pinned, reviewed package versions.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Non-Reproducible Third-Party Dependency Resolution
- Content
View full analysis
=2.0.0 numpy>=1.24.0 ``` `README.md`, line 36: ```bash pip install -r requirements.txt ``` `DELIVERY.md`, line 57: ```bash pip install -r requirements.txt ``` ### Technical Analysis The dependency file specifies only lower version bounds. Consequently, installation may resolve to any current or future releases satisfying those constraints, along with varying transitive dependencies. The package does not provide exact pins, a lockfile, artifact hashes, or a trusted-index restriction. This is a supply-chain hardening deficiency rather than evidence that either named package is malicious. The audited repository therefore does not uniquely determine the third-party code that will be installed. Python package installation may download wheels or source distributions. Source distributions can execute build-backend logic during installation, while all installed packages subsequently execute with the permissions of the process importing or running them. A compromised package release, package-index configuration, dependency-resolution change, or malicious transitive dependency could therefore introduce code that was not part of this audit. ### Attack Path 1. A user follows the documented installation command. 2. The package installer queries its configured package index or mirror. 3. Because only minimum versions are specified, it selects the newest dependency graph satisfying the constraints. 4. The installer downloads artifacts that were not fixed or verified by this repository. 5. Installation or build logic executes with the invoking user's permissions. 6. If a resolved artifact or configured index is compromised, malicious code can execute during installation or later when t ...[truncated 973 chars]- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
L044 明确写明“所有文档使用中文编写”，这是对语言/locale 的固定要求。该文件未说明这是面向特定中文地区用户的限定场景，也未提供用户选择其他语言的选项，因此构成自然语言层面的语言策略风险。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill documentation is presented in Chinese from the title onward, and the file does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy issue.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation text says the skill should be used when users ask about buy/sell timing or strategy analysis, which is broad and lacks clear boundaries for when this skill should or should not activate. It does not provide a constrained trigger list, exclusions, or negative examples, so ordinary market discussion could unintentionally invoke the skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The file is entirely framed as a Chinese stock-strategy agent and prescribes a fixed communication style in Chinese, but it does not state that the locale/language is optional or limited to a justified region-specific context. Under SQP-3, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly says it will record users' historical analysis requests to support continuity, but it provides no notice about retention, consent, storage limits, or privacy handling. Because stock analysis requests may reveal sensitive financial interests or behavioral patterns, silent persistence creates a real privacy risk and unnecessary data exposure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The document title and all instructions are written exclusively in Chinese, which imposes a specific language on users without any stated opt-in or alternative language option. Under the policy, locale or language constraints should either be optional or clearly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This Python file contains natural-language descriptions and user-facing help text only in Chinese, beginning with the module docstring. The policy for this category flags language/locale constraints when a skill forces a specific language without offering user choice or documenting a justified regional scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The argparse description, argument help strings, and status output are all Chinese-only, which makes the skill's user-facing interface language-specific without opt-in. This matches the natural-language policy violation category for forced language/locale behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file presents the skill identity entirely in Chinese, including the title and descriptive fields, without indicating that language choice is optional or user-selectable. Under the stated policy, fixed language presentation can be a locale-policy issue when no opt-in or alternative is offered.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The file uses Chinese column headers (日期, 开盘, 最高, 最低, 收盘, 成交量), which imposes a specific language choice in the artifact. Because no accompanying text offers a language option or documents a justified region-specific constraint, this may violate the language/locale policy criteria.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency is specified with a lower-bound version only, so builds can resolve to different pandas releases over time. This weakens supply-chain control and can unexpectedly introduce vulnerable or breaking versions, although by itself it does not prove active exploitation.
- Content
text pandas>=2.0.0 numpy>=1.24.0
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The numpy requirement is unpinned, which allows non-deterministic dependency resolution and increases supply-chain risk. An environment created later could pull a newly introduced vulnerable or incompatible release without any manifest change.
- Content
text pandas>=2.0.0 numpy>=1.24.0
Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
Manifest 将该技能描述为基于技术分析的分析工具，而该脚本除计算指标外，还支持通过命令行参数把结果写入任意指定文件。对于“分析工具”而言，读取输入并输出分析结果是预期的，但落盘写文件属于额外行为，超出了描述中直接表达的分析范围。
- Content