T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/statistical_arbitrage.py:2- Finding
Deliberately Obfuscated Implementation Reduces Auditability
- Content
View full analysis
- Remediation
View remediation
Security audit
Statistical Arbitrage 統計套利
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real statistical-arbitrage tool, but its documented user controls do not match the executable behavior, which can produce misleading financial analysis.
Review before installing. Use only in an isolated virtual environment, do not rely on its results for investment decisions, and require fixes for argument parsing, removal of hard-coded securities/dates, readable source, accurate reporting claims, and pinned dependencies before treating it as a trustworthy analysis tool.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
scripts/install_deps.sh:28- Finding
Unpinned Third-Party Dependencies Are Installed from Mutable Upstream Sources
- Content
View full analysis
=0.2.28 pandas>=2.0.0 numpy>=1.24.0 statsmodels>=0.14.0 matplotlib>=3.7.0 ``` From `package.json`: ```json "scripts": { "test": "python3 scripts/statistical_arbitrage.py --stock1 AAPL --stock2 GOOGL --start 2023-01-01 --end 2023-12-31 --test", "install-deps": "pip install yfinance pandas numpy statsmodels matplotlib" } ``` ### Technical Analysis The installation commands request package names without exact versions or artifact hashes. The requirements file only specifies lower bounds, allowing any future compatible release to be selected. Python packages can execute package-controlled build or installation logic during installation. They are subsequently imported by the verification command and by the main script. Consequently, a compromised upstream account, malicious future release, compromised package index, or dependency-resolution change could introduce unreviewed code after this Skill has been audited. No typosquatted package name or currently malicious dependency was established by the available evidence. The finding concerns mutable and unverified dependency resolution rather than a confirmed malicious package. ### Attack Path 1. A maintainer account, upstream release process, package index, or transitive dependency is compromised. 2. A malicious version satisfying the unconstrained command or `>=` requirement is published. 3. The user or Age ...[truncated 1012 chars]- Remediation
View remediation
other
Error
- Location
scripts/statistical_arbitrage.py:21- Finding
Documented User Parameters Are Silently Ignored in Favor of Hard-Coded Securities and Dates
- Content
View full analysis
\ --stock2 <股票2> \ --start <開始日期> \ --end <結束日期> \ --entry <入場閾值> \ --exit <出場閾值> \ --stop <止損閾值> \ --capital <初始資金> \ --output <輸出目錄> ``` ### Technical Analysis The program imports no command-line argument parser and never reads `sys.argv`. Python therefore starts normally when the documented options are supplied, but the options have no effect. The analysis always uses: - `1398.HK` a ...[truncated 1957 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The code is clearly related to statistical arbitrage and pair-trading backtesting, so the overall domain matches. However, several key declared capabilities are overstated or inaccurate. The description says it calculates dynamic hedge ratios, but the code fits a single OLS regression on the training data and reuses that constant beta throughout both train and test backtests. The description also says it generates a complete report, yet the implementation only prints textual summaries to stdout and does not create any structured report artifact. Finally, the claimed multi-market support is not really implemented as dedicated support logic; the script merely passes ticker strings into yfinance and is configured with a single hard-coded pair. These are material description-versus-behavior discrepancies, though not unrelated or malicious extra capabilities.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
All user-facing instructions, examples, and warnings are presented in Traditional Chinese, and the document does not state that the skill supports other languages or that Chinese is an intentional region-specific constraint. This can constitute a language policy issue because it effectively forces a specific language without user opt-in.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
Using
npx clawhub@latest install statistical-arbitragepulls and executes the latest published package version at install time, which creates a supply-chain risk if the package is compromised or updated maliciously. In a skill installation context, this can lead users to run unreviewed code with their local user permissions.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The README shows the skill being invoked by generic conversational phrases like '幫我分析 AAPL 和 GOOGL 的統計套利策略' rather than documenting a specific trigger syntax or activation scope. Because the file does not clarify what exact phrases activate the skill or provide negative examples, the trigger condition is ambiguous and could overlap with ordinary requests for analysis.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
Examples such as '分析工行和建行的配對交易' and '分析2022年到現在的騰訊和阿里的配對交易' are natural conversational requests, but the README does not specify whether these are merely sample prompts or the exact activation mechanism. Without explicit trigger constraints, the skill description leaves invocation behavior overly broad.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directs the agent to perform runtime package installation with pip, which expands its capabilities beyond analysis into software modification and network retrieval. This creates supply-chain and environment-integrity risk: unpinned dependencies can change over time, malicious packages or compromised mirrors could be installed, and the runtime environment may be altered in ways the user did not intend.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The package description is written entirely in Traditional Chinese, which creates a natural-language locale constraint in user-facing metadata. There is no indication of multilingual support, user opt-in, or a documented reason that this skill must be Chinese-only.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script’s user-facing comments and output strings are entirely in Chinese, including the example invocation phrase shown to users. For a general-purpose install script, this imposes a language/locale constraint without opt-in or justification, which matches the policy-violation category for language or locale restrictions.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest description and usage guidance combine Chinese text with English phrasing, effectively steering interactions toward specific languages without explicitly stating that users may choose their preferred language. The policy requires avoiding language constraints unless the skill offers an opt-in or clearly justified locale limitation.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation states '所有數據處理在本地進行' and '不收集或上傳用戶數據', yet elsewhere the skill explicitly relies on
yfinanceand mentions public API data downloads. While market-data retrieval is expected for this skill, the security note overstates locality by implying a fully local operation despite network access being part of execution.- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The dependency is specified with a minimum version only, which allows future unresolved versions to be installed. This weakens build reproducibility and can unintentionally introduce vulnerable or breaking upstream releases into the skill's execution environment.
- Content
text yfinance>=0.2.28 pandas>=2.0.0 numpy>=1.24.0 statsmodels>=0.14.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
Using pandas>=2.0.0 permits installation of any newer pandas release, making the deployed package set non-deterministic. In a security context this increases supply-chain risk because a vulnerable or compromised upstream release could be pulled without changes to the manifest.
- Content
text yfinance>=0.2.28 pandas>=2.0.0 numpy>=1.24.0 statsmodels>=0.14.0 matplotlib>=3.7.0
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The unpinned numpy requirement allows dependency resolution to select arbitrary newer releases over time. That creates avoidable supply-chain and stability risk, especially for numerical packages that may receive frequent binary and security-related updates.
- Content
text yfinance>=0.2.28 pandas>=2.0.0 numpy>=1.24.0 statsmodels>=0.14.0 matplotlib>=3.7.0
Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
Specifying statsmodels with only a lower bound means future installs are not reproducible and may pick up vulnerable or incompatible releases. This is a genuine dependency hygiene issue even though it is not an immediate exploit by itself.
- Content
text yfinance>=0.2.28 pandas>=2.0.0 numpy>=1.24.0 statsmodels>=0.14.0 matplotlib>=3.7.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
matplotlib is not pinned to a specific release, so the environment can drift over time and ingest unreviewed upstream versions. This increases supply-chain uncertainty and can complicate incident response or reproducibility.
- Content
text pandas>=2.0.0 numpy>=1.24.0 statsmodels>=0.14.0 matplotlib>=3.7.0
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Lines L015-L016 hard-code plotting font preferences to specific Chinese-capable fonts, which imposes a locale/language presentation choice at runtime. Under the policy, forcing a specific language or locale without user choice should be flagged unless it is clearly justified as region-specific, which is not documented here.
- Content
Static analysis
No suspicious patterns detected.