CompanyInformation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:50 AM UTC
• Version: 1.0.1

Overview

The skill performs the advertised company-news lookup, but it mishandles API keys in ways users should review before installing.

Install only if you are comfortable with a review-risk skill. Do not paste API keys into chat or agent memory, do not run commands that print .env, prefer a scoped environment variable or secure secret store, and treat any key used with this version as exposed because the script sends it over plaintext HTTP in query parameters. Be careful opening generated CSV files in spreadsheet software.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/query_company_information.py:35

Finding

API Credential Exposed Through Plaintext HTTP and URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: scripts/query_company_information.py, lines 35 and 70–103
Vulnerability Type: Plaintext credential transmission and credential disclosure through URLs
Risk Level: High

Vulnerable Code

python

FEEDAX_BASE_URL = "http://221.6.15.90:18011"

python

url = f"{FEEDAX_BASE_URL}/data-service/v1/news/company/external/query?apiKey={api_key}"

params = {"apiKey": api_key}

headers = {
    "Content-Type": "application/json",
    "x-api-key": api_key
}

try:
    response = requests.post(
        url,
        params=params,
        headers=headers,
        json=payload,
        timeout=60
    )
    response.raise_for_status()
    return response.json()
except requests.exceptions.RequestException as e:
    print(f"Request failed: {e}")
    sys.exit(1)

Technical Analysis

The FEEDAX API is accessed using unencrypted HTTP. The API key is included in the URL query string and is also supplied through both params and the x-api-key header.

Plain HTTP provides neither transport confidentiality nor server authentication. An attacker capable of observing or modifying network traffic can recover the API key, inspect company searches, alter API responses, or impersonate the server.

Placing credentials in query parameters creates additional exposure because complete URLs are commonly recorded by:

• Reverse proxies and HTTP access logs
• Network monitoring products
• Debugging and error-reporting systems
• Application performance monitoring tools
• Gateway and intermediary infrastructure

Because the URL already contains apiKey and params contains it again, the resulting request may contain the secret twice in the query string. Sending it in a header as well does not reduce the exposure.

Attack Path

1. A user configures a valid FEEDAX API key and invokes the query script.
2. The script constructs an HTTP request cont ...[truncated 1264 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the IP-based HTTP endpoint with an authenticated HTTPS hostname operated by FEEDAX:

   python

   FEEDAX_BASE_URL = "https://api.feedax.example"
   

2. Refuse to send credentials when the configured URL does not use HTTPS.
3. Send the API key exactly once, preferably in an authorization header:

   python

   url = f"{FEEDAX_BASE_URL}/data-service/v1/news/company/external/query"
   headers = {
       "Content-Type": "application/json",
       "Authorization": f"Bearer {api_key}",
   }
   response = requests.post(url, headers=headers, json=payload, timeout=60)
   

4. Do not place credentials in URLs or query parameters.
5. Use a DNS hostname whose certificate can be validated rather than disabling TLS verification or connecting directly to an IP address.
6. Rotate any API key previously transmitted through this implementation.
7. Review proxy, gateway, and monitoring logs for leaked query-string credentials.
8. Add automated tests that reject non-HTTPS endpoint configuration and verify that generated URLs never contain the API key.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:23

Finding

Excessive Secret Access and Unsafe Instructions to Retain API Keys

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23–41 and 509–512
Vulnerability Type: Excessive access to environment secrets and unsafe credential retention
Risk Level: High

Vulnerable Instructions

bash

cat .env

The associated instruction tells the agent to ask the user to provide the API key so that it can be remembered.

A later execution step instructs the agent to run:

bash

cat .env | grep FEEDAX_API_KEY

Technical Analysis

The Skill only needs to determine whether FEEDAX_API_KEY is configured. Reading the entire .env file with cat .env exceeds that requirement because such files commonly contain unrelated database credentials, cloud keys, signing secrets, payment tokens, and other sensitive configuration.

Even the filtered command exposes the value of FEEDAX_API_KEY to the command output and therefore to the agent context. A presence check should not disclose the value.

Asking the user to provide an API key so the agent can “remember” it is also unsafe. It encourages users to place a long-lived credential in conversation history or persistent agent state rather than in a dedicated secret store. The Python script itself can already obtain the key from an environment variable or local configuration, so conversational retention is unnecessary for the declared functionality.

Attack Path

1. The agent loads the Skill and follows its mandatory API-key configuration procedure.
2. The agent executes cat .env.
3. Every secret in the project-level .env file is returned to the agent context, not only the FEEDAX key.
4. The values may consequently appear in model context, command transcripts, telemetry, logs, or retained conversation history.
5. If no key exists, the agent asks the user to submit the key in chat for future remembrance.
6. The submitted credential may become part of persistent conversation or memory state.
7. Any party with access to thos ...[truncated 737 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all instructions that print .env or reveal the API-key value.
2. Replace them with a local presence check that emits only a boolean result:

   bash

   if [ -n "${FEEDAX_API_KEY:-}" ]; then
     printf '%s\n' "FEEDAX_API_KEY is configured"
   else
     printf '%s\n' "FEEDAX_API_KEY is not configured"
   fi
   

3. If loading from a file is necessary, use a helper that reports only whether the named variable is present and never prints its value.
4. Remove the instruction asking users to provide secrets in conversation or allow the agent to remember them.
5. Explicitly state that API keys must not be pasted into chat, logs, generated Markdown, or agent memory.
6. Prefer an operating-system credential store, deployment secret manager, or protected environment variable.
7. Ensure local secret files have restrictive permissions and are excluded from version control.
8. Rotate credentials if .env has already been displayed in an agent session or recorded in logs.

T08 · Insecure Dependencies

Warning

• Location: README.md:55

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 55–59
Vulnerability Type: Uncontrolled dependency resolution
Risk Level: Medium

Vulnerable Instruction

bash

pip install requests

Technical Analysis

The installation instruction retrieves the latest version of requests and its transitive dependencies available from the user's configured Python package index. The project provides no reviewed version constraint, lock file, package hashes, or trusted-index restriction.

The package name is legitimate and no dependency-confusion or typosquatting package is present in the reviewed files. Nevertheless, the unpinned command makes the effective installed code change over time and prevents reproducible dependency review.

If a future dependency release, transitive package, configured package mirror, or package-index account is compromised, following the documented installation process could introduce attacker-controlled code.

Attack Path

1. A user follows the documented setup process.
2. pip resolves the newest available requests release and its transitive dependencies from the configured index.
3. A compromised package release, malicious package mirror, or altered dependency is selected.
4. Package installation or subsequent import executes the affected package code in the user's Python environment.
5. The malicious dependency acts with the permissions of the user running pip or the query script.

Impact Assessment

Exploitation could provide code execution with the privileges of the installing user or runtime process. Depending on those privileges, an attacker could access local files, environment variables, API keys, generated company-information reports, and network resources.

The practical risk is reduced if installation occurs in an isolated virtual environment from the official Python Package Index, but the current documentation does not require either protection.

Remediation

View remediation

Remediation Suggestions

1. Add a reviewed dependency file with exact versions:

   text

   requests==REVIEWED_VERSION
   

2. Generate and verify cryptographic hashes for the dependency and every transitive dependency.
3. Install using a hash-enforcing workflow:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Use a lock-file tool such as pip-tools, Poetry, or an equivalent reproducible dependency manager.
5. Require installation in a dedicated virtual environment rather than the system Python environment.
6. Use an approved package index and explicitly configure trusted repository sources.
7. Enable automated dependency vulnerability and integrity scanning.
8. Review and update pinned versions through a controlled maintenance process.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/query_company_information.py:123

Finding

Spreadsheet Formula Injection in Generated CSV Reports

Content

View full analysis

Vulnerability Details

File Location: scripts/query_company_information.py, lines 123–181
Vulnerability Type: CSV formula injection through untrusted API fields
Risk Level: Medium

Vulnerable Code

python

row = [
    release_date_str,
    item.get('articleTitle', '') or '',
    item.get('articleSummary', '') or '',
    item.get('infoSource', '') or '',
    item.get('articleSentiment', '') or '',
    stock_code,
    stock_short,
    industry_name,
    comp_name,
    comp_alias,
    str(item.get('publicOpinionHeatScore', 0) or 0),
    event_tag_str,
    item.get('articleUrl', '') or ''
]

row = [str(v).replace(',', ' ').replace('\n', ' ') for v in row]
f.write(','.join(row) + '\n')

Technical Analysis

Data returned by the remote API is written directly to a CSV file. The implementation removes commas and newline characters, but it does not neutralize spreadsheet control prefixes.

Spreadsheet applications may interpret cells beginning with characters such as =, +, -, or @ as formulas. Quoting CSV values alone is not sufficient because spreadsheet software can still evaluate quoted cell content as a formula.

Potentially affected fields include article titles, summaries, sources, company names, aliases, stock information, industry names, event tags, and article URLs. These values are controlled by the remote service and may also originate from third-party news sources.

The use of manual string concatenation rather than Python's csv module additionally produces fragile CSV serialization, although the primary security issue is the absence of formula neutralization.

Attack Path

1. An attacker causes a news record or other upstream data source to contain a value beginning with a spreadsheet formula marker.
2. FEEDAX returns that value in a field such as articleTitle, articleSummary, compName, or articleUrl.
3. The script copies the value into `compan ...[truncated 941 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat every value returned by the API as untrusted.
2. Neutralize cells whose first non-whitespace character is =, +, -, or @.
3. Prefix dangerous cells with a single quote or another format-appropriate neutralization character:

   python

   def sanitize_csv_cell(value):
       text = str(value or "").replace("\r", " ").replace("\n", " ")
       if text.lstrip().startswith(("=", "+", "-", "@")):
           return "'" + text
       return text
   

4. Use Python's csv module for correct field quoting:

   python

   import csv
   
   with open(output_path, "w", encoding="utf-8", newline="") as output_file:
       writer = csv.writer(output_file)
       writer.writerow(headers)
       writer.writerow([sanitize_csv_cell(value) for value in row])
   

5. Apply sanitization to every field, including titles, summaries, sources, aliases, tags, and URLs.
6. Consider generating a non-formula format for untrusted content or explicitly importing values as text.
7. Add tests covering leading formula markers, leading whitespace before markers, carriage returns, newlines, commas, and quotation marks.
8. Document that exported data originates from external sources and should be opened with spreadsheet formula execution disabled where possible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill instructs reading the local .env file to inspect API-key presence, which is credential-access behavior. In an agent context, directing the model to access local secret files broadens exposure to unrelated secrets and creates a pathway for sensitive configuration data to be processed unnecessarily.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

查看 .env 文件是否存在且包含有效的 API Key：

bash

cat .env

如果未配置

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The instruction explicitly asks the user to tell the assistant their API key so the assistant can 'remember' it. This is dangerous because it normalizes sharing secrets through chat, increases the risk of logging or retention of credentials, and bypasses proper secret-management controls.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The workflow explicitly runs cat .env | grep FEEDAX_API_KEY as a first step, embedding credential-file inspection into standard execution. Because the skill's purpose is news retrieval rather than secret management, this context makes the credential-access instruction less justified and more dangerous.

Content

Scanner excerpt · SKILL.md (reported line 509)May include surrounding context.

Step 1: 检查 API Key 配置

bash

cat .env | grep FEEDAX_API_KEY

• 如果返回空或文件不存在，提示用户："未配置 API Key，请前往 https://www.feedax.cn 申请，完成后请告诉我 API Key 以便我记住"

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The workflow repeats the instruction to have the user disclose their API key for retention by the assistant, reinforcing an unsafe secret-handling pattern. Repetition in the operational flow makes accidental credential disclosure more likely and more systemic.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documentation, examples, parameter values, and usage instructions are entirely in Chinese, and there is no indication that users may interact in other languages or that the language restriction is optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly justified.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill describes capabilities to read environment files, execute CLI commands, write local files, and call a network API, but it does not declare any explicit tool scope or permission boundaries. This creates an overprivileged and opaque execution model where an agent may perform sensitive actions beyond what users would reasonably expect from a company-news lookup skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to inspect local credential storage and, if missing, ask the user to provide an API key 'so it can remember it.' Requesting the user to disclose a secret to the assistant for retention is unsafe because it encourages credential exfiltration into the chat channel and unnecessary long-term handling of secrets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill says it will automatically save all returned data to local CSV and MD files without clearly requiring user awareness or consent at execution time. Automatic local writes can create unintended data retention, leak potentially sensitive query results to shared environments, and surprise users who only requested a lookup.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation directs the agent to perform local shell execution and file inspection as part of normal operation, even though the skill's stated purpose is simply retrieving company-information results. This expands the operational surface unnecessarily and increases the risk of command misuse, unsafe file access, and behavior that exceeds user expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script sends the API key in the URL query string, request parameters, and headers to an HTTP endpoint with no TLS. This exposes credentials and query contents to interception, logging by intermediaries, and tampering via man-in-the-middle attacks, which is especially risky because the tool handles potentially sensitive monitoring targets and returns externally sourced content.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/query_company_information.py (reported line 103)May include surrounding context.

python

}
    
    try:
        response = requests.post(url, params=params, headers=headers, json=payload, timeout=60)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The natural-language instructions, trigger examples, parameter explanations, and user interaction examples are effectively constrained to Chinese, but the file does not state that this is a region-specific or language-specific skill nor offer user opt-in for that locale. This can violate language/locale policy when users are not given a choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Earlier documentation states that each item must include 11 core fields, and section 7.1 repeats that requirement. But the execution flow later says the dialogue should display only 10 mandatory fields, which is an active contradiction in the skill's own instructions about intended behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script's docstring, CLI descriptions, examples, and runtime messages are all presented only in Chinese, with no indication that users may choose another language or locale. This can violate a language/locale policy when a skill imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The manifest describes a company information and public-opinion query skill, but does not mention local credential discovery from process environment or filesystem configuration. While the outbound FEEDAX API call is expected, adding environment/config-file credential harvesting expands capability beyond the user-facing purpose described.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest focuses on querying and analyzing company news and sentiment data, not reading local files for configuration or secrets. This local file access is a separate capability that may be reasonable operationally, but it is not justified by the stated purpose as written.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.