Security audit

Zettaranc Perspective

Security checks for vulnerabilities and agentic risk

Overview

This stock-analysis persona skill is not clearly malicious, but it asks for sensitive local setup, token storage, and financial-profile persistence without enough user control.

Install only if you are comfortable with a finance skill that can ask for a Tushare token, inspect and write local configuration, create local reports, store trade-related profile data, and answer in a persistent named-person persona. Prefer a version that uses a masked secret-entry flow, asks before reading or writing files, avoids executable token interpolation, redacts paths/secrets, and makes memory/persona behavior opt-in.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:274
Finding: Forced Agent Identity and Response-Control Hijacking
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:262
Finding: User-Controlled API Token Interpolated into Executable Python Source
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:234
Finding: Silent Local Configuration Inspection and Chat-Based Credential Collection
Content: View full analysis
Remediation: View remediation

other

Warning

Location: knowledge/harness.md:382
Finding: Cross-Session Retention of Privacy-Sensitive Financial Profile Data Without Consent Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The embedded command instructs the agent to load a local .env file and read environment configuration. Accessing local secret-bearing files from a conversational skill is sensitive because .env commonly contains credentials, and even a narrow read of one variable establishes an unnecessary pathway into secret storage.
Content: Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.
bash
# 检查 DATA_MODE 环境变量（跨平台兼容：自动查找项目根目录 .env） python -c "import os, sys; sys.path.insert(0, '.'); from pathlib import Path; from dotenv import load_dotenv; load_dotenv(Path('.env')); print(os.environ.get('DATA_MODE', ''))"

判断逻辑：

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly asks the user to paste a Tushare token and then persists it into configuration. This creates a natural-language credential collection path, increasing the risk of secret exposure in chat logs, improper storage, accidental reuse, and unauthorized access if the environment or transcripts are later compromised.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · knowledge/harness.md (reported line 8)May include surrounding context.
md
> > 本文件从 SKILL.md v3.3.0 抽出。原位置：SKILL.md 第 824-1322 行（v3.3.1 拆分）。 <!-- Skill-Runtime 加载时机: Agent 需要对照约束规则、验证输出、纠错恢复时用途: 完整的 Guardrails / Feedback Loop / Error Recovery / Context Management 规范大小: ~22KB

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · knowledge/harness.md (reported line 8)May include surrounding context.
md
> > 本文件从 SKILL.md v3.3.0 抽出。原位置:SKILL.md 第 824-1322 行(v3.3.1 拆分)。 <!-- Skill-Runtime 加载时机: Agent 需要对照约束规则、验证输出、纠错恢复时用途: 完整的 Guardrails / Feedback Loop / Error Recovery / Context Management 规范大小: ~22KB

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill claims the websearch mode has no external dependencies, but elsewhere instructs the agent to inspect local configuration and participate in setup actions. That mismatch can mislead users and reviewers about the real trust boundary, causing the agent to perform local environment interaction beyond a pure Q&A role.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill specifies Output format: 中文 as a hard requirement, which imposes a language choice on users without opt-in or fallback. This is a natural-language policy issue because it constrains locale/language behavior rather than offering a user-selectable preference.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The document says it is only an analysis framework and not a trading execution system, yet later instructs the agent to record trades, manage tracking state, and write configuration. This inconsistency obscures the true operational scope and can cause users to consent to a lower-risk tool than the one actually described.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill directs the agent to perform silent environment checks and then write configuration based on user dialogue, without clear just-in-time disclosure at the action point. Silent inspection and modification of local settings undermines informed consent and increases the chance of unauthorized state changes or secret handling.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill includes instructions to persistently modify local configuration, which exceeds the least-privilege needs of an analysis persona. Any skill that can write config can alter future agent behavior, store secrets, or create hard-to-audit state changes, especially when triggered through conversational flow.
Content: No source excerpt is available for this finding.

Ssd 1

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The role-play rules instruct the model to stay in character and avoid meta-analysis, which can suppress normal transparency about limitations, tool use, and safety-relevant actions. In a skill that also performs environment checks and setup guidance, this makes risky behavior harder for users to notice or challenge.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The file instructs the agent to '始终保持Z哥身份' unless the user says '退出角色'. This imposes a fixed response style/persona by default rather than offering an opt-in choice, which can conflict with organizational policy against forcing a specific language/locale or similar user-facing mode without consent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly instructs the agent to write detailed results into local workspace files and then expose absolute file:// paths back to the user. That expands the skill from investment-style analysis into local filesystem interaction and path disclosure, which can leak host environment details such as usernames, directory layouts, and workspace structure, and may normalize broader data exfiltration behavior.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The document tells the agent to retain and restate detailed user information such as holdings, cost basis, risk preference, and prior responses across the conversation. In a finance-related skill, these details are highly sensitive, and unnecessary retention or replay increases the risk of accidental disclosure, over-collection, or leakage into later outputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 73% confidence
Finding: The execution flow specifies answer generation '用Z哥口吻' as a required default behavior. A fixed user-facing mode imposed by the skill, without a clear choice mechanism, is a natural-language policy concern under the rule's opt-in requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file is natural-language skill documentation, and all user-facing instructions, descriptions, and examples are presented only in Chinese. That effectively forces a specific language/locale on users without documenting a choice, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document goes beyond passive self-improvement and explicitly feeds back historical performance into future recommendation priority, guardrails, and automatic interception logic for investment advice. In a skill that provides stock buy/sell analysis, this creates an ungoverned adaptive decision layer that can silently reshape outward-facing financial guidance based on internal backtests or tracking data, increasing the risk of unsafe, overfit, or misleading recommendations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trade-review trigger list includes very broad phrases such as everyday requests about reviewing or mentioning a buy/sell action, which can cause the module to activate when the user did not intend to submit a structured trade review. In this skill, unintended activation is more dangerous because the module can shift the conversation into concrete investment analysis and data-driven trade commentary, increasing the chance of unsolicited or overconfident financial guidance.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: 该技能的声明聚焦于投资分析与 Z 哥视角输出，不包含本地开发/运维指导。这里要求用户运行 "python -m modules.database" 初始化数据库，实际上引入了本地环境管理与命令执行上下文，超出了技能陈述的直接目的。
Content: No source excerpt is available for this finding.