T08 · Insecure Dependencies
Warning
- Location
SKILL.md:6- Finding
Automatic Installation of Unpinned Third-Party Skills
- Content
View full analysis
- Remediation
View remediation
Security audit
Trader Simulator
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent stock-analysis simulator, but it needs review because it auto-installs external finance/search skills and may automatically use broad web or social tools for financial analysis.
Review the dependency list before installing, especially the auto-installed finance/search/monitoring skills. Treat the MX/Eastmoney API key as a secret, avoid pasting it into chat or source files, and use this skill only where automatic web/social lookups and stock-monitor changes are acceptable. It is not safe to treat the generated output as investment advice.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README advertises browser, search, and third-party content retrieval capabilities but does not warn users that prompts, stock interests, or other context may be sent to external services. In a financial-analysis skill, such undisclosed network access can expose sensitive trading interests, behavioral patterns, or account-linked context to outside providers.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The phrase "启动 [大师名]" is a common expression pattern and may collide with ordinary requests, especially in chat environments where users discuss starting tasks or personas informally. If mis-triggered, it can silently switch the agent persona and influence downstream financial guidance in ways the user did not intend.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrase "退出" is extremely generic and likely to appear in ordinary conversation, which can cause unintended deactivation of the skill or mode switching without clear user intent. In a multi-agent financial assistant, this raises the risk of accidental state changes that alter analysis behavior or suppress expected safeguards during a session.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The command "讨论 [股票]" is broad conversational language rather than a distinct control phrase, so normal discussion about a stock could unintentionally activate the multi-agent workflow. That can trigger unexpected tool use, external lookups, or role changes in a context where the user only intended casual conversation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README instructs users to obtain and configure an API key but provides no warning that the credential is sensitive or guidance on secure storage. This increases the chance users will paste secrets into chat, commit them to repositories, or expose them in logs, enabling unauthorized access to associated services.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The keyword list contains broad, common terms that can cause accidental or overly eager invocation of the skill in loosely related conversations. Unintended activation is risky here because the skill can trigger external data/search workflows and steer the assistant into finance-specific behavior without clear user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documented trigger phrases are broad natural-language expressions without clear activation boundaries, which increases the chance that ordinary discussion about a stock unintentionally enters multi-agent mode. In a skill that may call external tools and generate trading recommendations, ambiguous activation increases the likelihood of unrequested actions and misleading context switches.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to automatically inspect whatever tools are available and use arbitrary browser, social-media, search, and data capabilities beyond the narrowly declared stock-simulator dependencies. This creates scope creep and can cause an over-privileged agent to access unrelated external services or sensitive browsing contexts based only on natural-language prompts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The JSON content uses Chinese-only field values throughout, indicating a fixed language/locale with no visible opt-in, alternative locale, or documented regional justification in this file. The policy requires flagging language or locale constraints when they are imposed without user choice or clear justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This JSON contains natural-language fields, labels, and values presented exclusively in Chinese across the dataset, with no documented user choice or opt-in for language/locale. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code file contains user-facing natural-language descriptions and CLI output exclusively in Chinese, including the module description and later command help/messages. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and no alternative language option or justification is provided here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The skill instructions, examples, commands, and user-facing outputs are written to operate in Chinese, and no section offers an opt-in or alternative language choice. This can be a language-policy issue when skills should not assume a single language unless clearly optional or justified.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The example for 股神老徐 states '我从不推荐具体股票', presenting a no-recommendation behavioral intent for that persona. Elsewhere, the documented commands and features include '推荐股票' and say the current master can provide recommendations, creating an internal contradiction about what the persona/skill is intended to do.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The module docstring and user-facing usage text are entirely in Chinese, and the command interface later relies on Chinese labels such as “模拟” and “列出”. This creates a language-specific experience without any opt-in or documented justification, which matches the locale policy concern for natural-language content.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The script prints multiple Chinese-only status and help messages to users, including labels for built-in bloggers and analysis actions. Because there is no mechanism to choose language or confirm a China-specific locale constraint, the skill embeds a fixed language policy in natural-language strings.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The manifest describes a stock trading simulator for learning and multi-agent discussion, which primarily implies generating simulated analysis and recommendations. This file also implements persistent storage of custom master profiles in data/masters.json, which is additional configuration-management behavior not reflected in the manifest description.
- Content