Security audit

getmeastock

Security checks for vulnerabilities and agentic risk

Overview

This is a remote stock-analysis wrapper, but it stores API keys locally and can send those credentials and your prompt to a configurable server.

Review before installing. Use only the intended Prana/Claw endpoint, avoid passing a custom base URL, prefer environment variables or a secret manager over config/api_key.txt, set PRANA_SKILL_SKIP_WRITE_API_KEY=1 if using auto-fetch, and make sure config/api_key.txt is never committed or shared.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/prana_skill_client.py:461
Finding: API credentials and user content can be transmitted to an arbitrary endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/prana_skill_client.py:262
Finding: Fetched secret keys are persisted in plaintext with uncontrolled file permissions
Content: View full analysis
None: """将 public_key:secret_key 写入 config/api_key.txt（首行为注释，与现有读取逻辑兼容）。""" CONFIG_DIR.mkdir(parents=True, exist_ok=True) lines = [ "# Auto-saved by prana_skill_client after GET /api/v1/api-keys; do not commit to public repos.", f"{public_key}:{secret_key}", "", ] API_KEY_FILE.write_text("\n".join(lines), encoding="utf-8") ``` Python default persistence path: ```python if base and not _auto_fetch_api_key_disabled(): fetched = fetch_prana_api_keys_via_get(base) if fetched: pub, sec = fetched if not _skip_write_fetched_api_key(): try: _persist_fetched_api_key_txt(pub, sec) except OSError as e: print(f"警告: 无法写入 config/api_key.txt：{e}", file=sys.stderr) return pub, sec ``` Node.js persistence function: ```javascript function persistFetchedApiKeyTxt(publicKey, secretKey) { fs.mkdirSync(CONFIG_DIR, { recursive: true }); const lines = [ '# Auto-saved by prana_skill_client after GET /api/v1/api-keys; do not commit to public repos.', `${publicKey}:${secretKey}`, '', ]; fs.writeFileSync(API_KEY_FILE, lines.join('\n'), 'utf8'); } ``` Node.js default persistence path: ```javascript if (base && !autoFetchApiKeyDisabled()) { const fetched = await fetchPranaApiKeysViaGet(base); if (fetched) { const [pub, sec] = fetched; if (!skipWriteFetchedApiKey()) { try { persistFetchedApiKeyTxt(pub, sec); } catch (e) { console.error(`警告: 无法写入 config/api_key.txt：${e && e.message ? e.message : e}`); } } return [pub, sec ...[truncated 2176 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: package.json:6
Finding: Node installation resolves a non-locked third-party dependency
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Undisclosed calls to agent-run/result endpoints, automatic retrieval of public/secret keys, and writing API credentials to config/api_key.txt materially expand the risk surface beyond a normal stock-analysis skill. In this context, the deception is especially concerning because a finance-themed skill does not reasonably imply infrastructure-client behavior or local credential persistence.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Undisclosed calls to agent-run/result endpoints, automatic retrieval of public/secret keys, and writing API credentials to config/api_key.txt materially expand the risk surface beyond a normal stock-analysis skill. In this context, the deception is especially concerning because a finance-themed skill does not reasonably imply infrastructure-client behavior or local credential persistence.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.
md
- **Node.js 18+**：先在包根目录执行 **`npm install`**，再执行 `node scripts/prana_skill_client.js -m "…" [-t thread_id] [-b base_url]`

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README explicitly documents that the client will automatically fetch API credentials and write them to config/api_key.txt by default. Storing long-lived secrets in a predictable plaintext file increases the chance of accidental disclosure through local compromise, backups, logs, packaging, or repository inclusion, especially because this package is intended for broad third-party use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README instructs users to paste either full API key JSON or public_key:secret_key directly into a plaintext file. That normalizes insecure secret handling and makes credential leakage more likely via source control, shared directories, shell history, endpoint malware, or support bundle collection.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises executable client scripts and credential-based API access, but the manifest shown does not declare any tool scope or permissions. That makes the skill's ability to use network, local files, and environment-derived secrets non-transparent, which increases the chance of over-privileged execution and unsafe deployment decisions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill description and usage instructions are written entirely in Chinese, which can indicate a language-specific constraint. The file does not offer an alternative language, user opt-in, or explain that the skill is intentionally limited to Chinese-language users or A-share market contexts, creating a potential language/locale policy issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The markdown instructs users to supply an x-api-key in public_key:secret_key format and references local credential storage, but it does not warn about the sensitivity of those secrets or safe handling practices. This can lead to accidental exposure through shell history, logs, screenshots, copied commands, or insecure files, especially because the skill already appears to manage credentials locally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This code file contains user-facing CLI errors and prompts entirely in Chinese, beginning with the message on L077 and continuing throughout the script. Under the policy for natural-language violations, forcing a specific language without user opt-in is a locale/language policy issue because users are not offered any alternative or configuration.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The skill's stated purpose is financial analysis of A-share stocks, but the wrapper reads ACCOUNT_ID plus multiple environment variables containing API secrets and uses them to provision access. Handling platform credentials may be an implementation concern for a generic client, yet it is not a capability justified by the business purpose described in the manifest.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The client will automatically fetch API credentials from a remote endpoint and, unless explicitly disabled, persist them to config/api_key.txt on disk. For a public stock-analysis skill, this expands the trust boundary and creates unnecessary secret-handling behavior that is not apparent from the skill description, increasing the risk of credential leakage through local filesystem exposure, accidental commits, or use against an attacker-controlled base URL.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The module docstring and user-facing messages are entirely in Chinese, which imposes a locale choice in natural-language interaction. Under the stated policy, forcing a specific language without opt-in or documented justification is a policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: When API keys are auto-fetched, the script persists them to config/api_key.txt by default without an explicit confirmation step. Storing long-lived credentials on disk can expose them to other local users, backups, accidental commits, or malware, turning a convenience feature into credential leakage risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script sends the user-provided message and API credentials to a remote service endpoint, but the CLI flow does not present a clear runtime warning, consent step, or privacy notice before transmission. In a stock-analysis skill, users may input sensitive trading ideas, account-related context, or proprietary research, so silent exfiltration to a third-party service creates a genuine confidentiality and informed-consent risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest uses Chinese-only natural-language text in the description and payment flow instructions, which effectively forces a specific language for understanding and use of the skill. The policy allows locale constraints only when they are explicitly justified or when users are given a language/locale choice, neither of which is present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: All instructional text in the file is written in Chinese, including setup and operational guidance, with no indication that the skill is intended only for a Chinese-speaking audience or that users may choose another language. This is a natural-language locale policy concern because it imposes a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: The dependency is specified with a caret range (^2.6.1), which allows newer minor and patch versions to be installed without explicit review. This weakens reproducibility and supply-chain control, and can result in unexpectedly pulling a vulnerable or breaking release in future installs.
Content: Scanner excerpt · package.json (reported line 7)May include surrounding context.
json
"type": "module", "description": "Prana encapsulated skill — install deps for the Node runner: npm install", "dependencies": { "yaml": "^2.6.1" }, "engines": { "node": ">=18.0.0"

Unverifiable Dependency: yaml has 2 known advisory(ies) (CVE-2026-33532 (yaml is vulnerable to Stack Overflow via deeply nested YAML collections); CVE-2023-2251 (Uncaught Exception in yaml)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 80% confidence
Finding: The manifest includes yaml without an exact pinned version, while known advisories exist for some yaml releases. Because the allowed version range is not fixed, installations may resolve to an affected version depending on when and where the skill is installed, creating avoidable uncertainty around denial-of-service conditions such as crashes or stack overflows during YAML parsing.
Content: No source excerpt is available for this finding.