T09 · Insecure Skill Coding Practices
Error
- Location
scripts/qieman_client.py:24- Finding
Hard-Coded Qieman MCP API Credential
- Content
View full analysis
- Remediation
View remediation
Security audit
Fund Analyzer Pro
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its fund-analysis purpose, but it handles sensitive financial data and credentials with enough overbroad, under-disclosed, and insecure behavior that users should review it carefully before installing.
Install only if you are comfortable with financial data being processed through external APIs, cached locally, and potentially monitored via a watchlist. Rotate or replace the bundled Qieman key, do not store real secrets in workspace markdown or shell profiles, avoid plaintext holdings export, and review the storage scripts before using uploaded portfolio files.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/encrypt-holdings.py:56- Finding
Path Traversal in Encrypted Holdings File Operations
- Content
View full analysis
Path: """Get the user's holdings file path.""" return HOLDINGS_DIR / f"{user_id}.enc" ``` The resulting path is then used for write, read, and deletion operations: ```python file_path = get_holdings_file(user_id) encrypted = encrypt_data(holdings) with open(file_path, 'wb') as f: f.write(encrypted) ``` ```python file_path = get_holdings_file(user_id) if not file_path.exists(): return None with open(file_path, 'rb') as f: encrypted = f.read() ``` ```python file_path = get_holdings_file(user_id) if file_path.exists(): file_path.unlink() return True ``` ### Technical Analysis `user_id` is not validated before being appended to `HOLDINGS_DIR`. `pathlib` does not automatically constrain paths to the base directory. A value containing parent-directory components can therefore resolve outside the intended holdings directory. For example, an identifier such as `../../target` produces a path ending in `../../target.enc`. The enforced `.enc` suffix limits which filenames can be targeted, but it does not prevent directory escape. The same unsafe path-building function is used by save, load, and delete operations. Consequently, the flaw supports three classes of unauthorized filesystem action: - Writing attacker-selected encrypted content outside the holdings directory. - Reading an outside `.enc` file and attempting to decrypt it. - Deleting an outside `.enc` file if the process account has permission. These capabilities exceed the minimum filesystem access needed to store records beneath `data/fund-holdings`. ### Attack Path 1. An attacker obtains access to an application or in ...[truncated 1004 chars]- Remediation
View remediation
Path: if not USER_ID_PATTERN.fullmatch(user_id): raise ValueError("Invalid user ID") base = HOLDINGS_DIR.resolve() candidate = (base / f"{user_id}.enc").resolve() if candidate.parent != base: raise ValueError("Holdings path escapes storage directory") return candidate ``` 2. Consider hashing the logical identifier and using the digest as the physical filename. 3. Reject absolute paths, separators, dot segments, null characters, and platform-specific alternate separators. 4. Apply the same validation to save, load, delete, and export operations. 5. Run the Skill under a dedicated low-privilege account with write access only to required data directories. 6. Add tests covering `../`, absolute paths, encoded separators, excessive lengths, and platform-specific path forms. 7. Use authorization checks in the calling layer so one user cannot select another user's holdings identifier. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/encrypt-holdings.py:20- Finding
Insecure Holdings Encryption-Key Storage and Plaintext Export
- Content
View full analysis
- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/fund_analyzer_pro.py:22- Finding
External Workspace Module Hijacking Through Python Search-Path Precedence
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ttfund-query.py:184- Finding
Plaintext HTTP Retrieval of Financial Market Data
- Content
View full analysis
`. 3. The attacker intercepts the plaintext request and supplies a forged HTTP response. 4. The Skill splits and accepts the forged fields as NAV, accumulated NAV, and price change. 5. The manipulated values are displayed or consumed by downstream analysis, producing inaccurate financial conclusions. ### Impact Assessment An attacker can compromise the confidentiality of queried fund identifiers and, more ...[truncated 319 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (87)
Tainted flow: 'headers' from os.environ.get (line 102, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python } try: response = requests.post( BASE_URL, headers=headers, json=payload,
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The README contains a plaintext x-api-key in the sample MCP configuration, which may expose a real credential or normalize unsafe secret-handling practices. If valid, attackers could use the key to access the MCP service, consume quotas, retrieve data, or impersonate legitimate usage; even if illustrative, publishing secrets in docs encourages insecure copying and reuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation includes tests that exercise local cache storage, encryption/decryption, persistence, and deletion of holdings, but these behaviors are omitted from the declared functionality, the gap undermines reviewability and informed consent. For a portfolio-analysis skill, undeclared data lifecycle operations are materially relevant because they affect confidentiality and integrity of user financial records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
If the implementation includes tests that exercise local cache storage, encryption/decryption, persistence, and deletion of holdings, but these behaviors are omitted from the declared functionality, the gap undermines reviewability and informed consent. For a portfolio-analysis skill, undeclared data lifecycle operations are materially relevant because they affect confidentiality and integrity of user financial records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
If the implementation includes tests that exercise local cache storage, encryption/decryption, persistence, and deletion of holdings, but these behaviors are omitted from the declared functionality, the gap undermines reviewability and informed consent. For a portfolio-analysis skill, undeclared data lifecycle operations are materially relevant because they affect confidentiality and integrity of user financial records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
If the implementation includes tests that exercise local cache storage, encryption/decryption, persistence, and deletion of holdings, but these behaviors are omitted from the declared functionality, the gap undermines reviewability and informed consent. For a portfolio-analysis skill, undeclared data lifecycle operations are materially relevant because they affect confidentiality and integrity of user financial records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the implementation includes tests that exercise local cache storage, encryption/decryption, persistence, and deletion of holdings, but these behaviors are omitted from the declared functionality, the gap undermines reviewability and informed consent. For a portfolio-analysis skill, undeclared data lifecycle operations are materially relevant because they affect confidentiality and integrity of user financial records.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Underspecified trigger phrases overlap with common user wording, making accidental invocation more likely. While this is less severe than a direct code-execution flaw, it still matters here because accidental activation could prompt collection of sensitive portfolio data or unnecessary external lookups.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Requesting Excel uploads of user holdings without an explicit sensitive-data warning is a real privacy and security issue because portfolio files can reveal assets, account structure, investment behavior, and personal financial status. In this skill’s context, the danger is elevated because the data may then be parsed, stored, exported, or sent to external services for analysis.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Automatic watchlist monitoring and push notifications involve ongoing processing and transmission of potentially sensitive financial preferences and behavior, yet the description does not clearly warn about privacy, retention, recipients, or notification channels. In the context of a fund-analysis skill, undisclosed monitoring is especially dangerous because it can create continuous data exposure beyond a one-time analysis request.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/signal_checker.py --list
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/signal_checker.py --list
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/signal_checker.py --list
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/signal_checker.py --list
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/signal_checker.py --list
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/signal_checker.py --list
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/signal_checker.py --list
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/signal_checker.py --list
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/signal_checker.py --list
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This section documents personalized holding-diagnosis behavior using the user's loss amount and then recommends actions like continuing to hold or adding via dollar-cost averaging, without any explicit warning about uncertainty, suitability limits, or financial risk. Because it appears tailored to a user's real position and losses, the risk is higher: users may reasonably interpret it as individualized financial advice and act on it to their detriment.
- Content
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
��户** | Excel 导入 | ✅ 100% | 免费 | ⭐⭐⭐⭐ |
方式 1：天天基金 API（推荐）
获取 API Key
步骤：
- 访问 https://skills.tiantianfunds.com/
- 注册账号
- 登录获取 API Key
- 复制到配置文件
配置：
bash # Linux/Mac export TTFUND_APIKEY="ttf_sk_live_xxx" # Windows set TTFUND_APIKEY=ttf_sk_live_xxx # 永久配置（推荐） echo 'export TTFUND_APIKEY="ttf_sk_live_xxx"' >> ~/.bashrc source ~/.bashrc验证：
bash echo $TTFUND_APIKEY # 应显示 API Key（部分隐藏）使用限制
项目 限制 免费额度 50 次/天 超出后 需付费或等待次日 并发限制 10 次/秒 可获取数据
数据类型 是否可用 说明 基金基础信息 ✅ 代码、名称、类型、规模 净值数据 ✅ 单位净值、累计净值 收益率 ✅ 近 1 月/1 年/3 年等 持仓数据 ✅
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Telling users to place an API key in TOOLS.md encourages storing a live secret in a plaintext documentation file inside the workspace, where it may be indexed, read by agents, synchronized, or accidentally committed. In an agent skill context, workspace-readable markdown is especially risky because other tooling may ingest it automatically, making exposure more likely than in a normal local-only config path.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This file implements persistent storage, enumeration, deletion, and plaintext export of user holdings, which materially expands the skill from analysis into local data collection and retention of sensitive portfolio information. In the context of a fund-analysis skill, that broader capability increases privacy and misuse risk because it enables accumulation and extraction of users' financial data beyond what is necessary for one-shot analysis.
- Content
exec() call detected
High
- Category
- Dangerous Code Execution
- Confidence
- 93% confidence
- Finding
This test file reads Python source from disk and executes it with exec(), which allows arbitrary code execution if either target script is modified, replaced, or symlinked to attacker-controlled content. In a skill environment where workspace files may be updated dynamically or shared across tools, this turns test execution into a code-loading sink without any integrity validation.
- Content
python # 执行脚本获取命名空间 qieman_ns = {} with open(scripts_path / "qieman-mcp-query.py", 'r', encoding='utf-8') as f: exec(f.read(), qieman_ns) encrypt_ns = {} with open(scripts_path / "encrypt-holdings.py", 'r', encoding='utf-8') as f:
exec() call detected
High
- Category
- Dangerous Code Execution
- Confidence
- 93% confidence
- Finding
This second exec() has the same core issue: it executes the full contents of a file from the skill workspace at runtime, so any tampering with encrypt-holdings.py results in arbitrary code execution during tests. Because the file being loaded appears security-sensitive, compromising it could also mask defects in encryption/storage behavior while executing payloads under the tester's privileges.
- Content
python encrypt_ns = {} with open(scripts_path / "encrypt-holdings.py", 'r', encoding='utf-8') as f: exec(f.read(), encrypt_ns) validate_fund_code = qieman_ns['validate_fund_code'] get_cache_key = qieman_ns['get_cache_key']
Static analysis
No suspicious patterns detected.