T08 · Insecure Dependencies
Warning
- Location
SKILL.md:266- Finding
Unpinned and Globally Installed Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
Stock Analysis China
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a stock-analysis and portfolio helper, but it can read unrelated local screenshots, overwrite or clear portfolio data, and guide broad environment changes without enough safeguards.
Install only if you are comfortable with the skill reading local inbound screenshots and storing/modifying portfolio holdings. Before use, require explicit confirmation before processing images, overwriting holdings, removing entries, or clearing all data, and avoid running the global/system install commands automatically.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/analysis_prompt_template.md:8- Finding
Unrelated Private Images May Be Read Through Ambiguous Latest-File Selection
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill’s declared purpose is narrow technical analysis, but the documented behavior expands into portfolio modification and destructive management actions while key advertised capabilities are not actually implemented. This mismatch is dangerous because users and the host agent may trust the skill under false assumptions, leading to unsafe invocation, overbroad data handling, or execution of side-effecting operations outside the expected scope.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The activation rules are extremely broad, including any image and nearly any stock-related request, which can cause the skill to trigger outside the user’s actual intent. Overbroad activation is dangerous here because the skill reads local files and may perform portfolio updates or analysis on sensitive financial data without clear consent.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill instructs the agent to read and update portfolio files but does not declare any explicit tool scope or permissions boundaries. This creates an authorization gap where file access is implied by documentation rather than constrained by policy, increasing the risk of unintended access to local user data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The skill is defined for 'A股' analysis and the instructions hardcode Chinese-language interaction and OCR settings such as 'chi_sim+eng'. While region-specific behavior may be valid, the file does not explicitly document this locale restriction as a user-facing limitation or offer a language/locale choice.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger phrase '每日一股' or similar wording is ambiguous and can match casual conversation, promotional text, or unrelated requests. In this skill, ambiguous activation matters because it can lead to unintended portfolio access or unsolicited investment-analysis behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The clear-portfolio command is documented without confirmation safeguards, so a simple phrase could trigger irreversible deletion of financial records. Because the data is user portfolio information, accidental activation or prompt confusion could directly cause loss of sensitive personal state.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The troubleshooting section directs the agent to perform system-level package installation, environment-variable changes, junction creation, and service restarts. These actions exceed the reasonable scope of a stock-analysis skill and could alter the host environment, introduce supply-chain risk, or disrupt unrelated services if followed automatically.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The template instructs the agent to automatically process the latest file from a shared inbound screenshot directory whenever the user sends a screenshot. This is risky because the trigger is broad and the file-selection logic is not bound to a verified user/session, creating a privacy and data-mixup hazard where unrelated screenshots could be analyzed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The workflow accesses inbound screenshots from a local media directory containing potentially sensitive user financial data, but it provides no explicit privacy notice, consent step, retention guidance, or restrictions on handling. In this skill context, screenshots likely contain portfolio holdings and account information, so silent ingestion increases the risk of unauthorized processing and disclosure.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md |------|---------| | Windows | `winget install tesseract-ocr.tesseract` | | macOS | `brew install tesseract` | | Linux (Ubuntu/Debian) | `sudo apt-get install tesseract-ocr` | | Linux (CentOS/RHEL) | `sudo yum install tesseract` | **中文语言包安装：**
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md |------|---------| | Windows | `winget install tesseract-ocr.tesseract` | | macOS | `brew install tesseract` | | Linux (Ubuntu/Debian) | `sudo apt-get install tesseract-ocr` | | Linux (CentOS/RHEL) | `sudo yum install tesseract` | **中文语言包安装：**
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
|------|------| | Windows | 下载
chi_sim.traineddata放入C:\Program Files\Tesseract-OCR\tessdata\| | macOS |brew install tesseract-lang或手动下载放入/usr/local/share/tessdata/| | Linux |sudo apt-get install tesseract-ocr-chi-sim或手动下载放入/usr/share/tesseract-ocr-4.00/tessdata/|调用命令（跨平台）：
bash
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The AI-result update replaces the entire portfolio from recognized input without warning or reconciliation, so recognition errors or malformed input can silently erase or corrupt existing holdings. Because the source may be screenshot OCR or model-extracted data, the risk is elevated by the inherent fallibility of AI parsing.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script exposes state-changing and destructive portfolio-management operations such as add, remove, clear, and bulk overwrite, while the skill description primarily frames the capability as analysis and advisory output. In an agent setting, this broadens the blast radius from read/analysis to persistent modification of user financial data, increasing the risk of accidental or unauthorized tampering.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The clear operation irreversibly wipes all saved portfolio data immediately, with no confirmation prompt, dry run, backup, or undo mechanism. In a financial holdings context, accidental invocation can destroy sensitive user state and disrupt later analysis or advice based on those records.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The CLI exposes administrative actions including full clear, deletion, and file/JSON-driven bulk updates that can directly rewrite persisted portfolio state. In a skill intended for end-user stock analysis, these controls are not adequately justified and create a pathway for mass unintended changes if invoked by automation, wrapper code, or a confused operator.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The documented ability to clear all portfolio data is broader than the stated analysis purpose and introduces a destructive operation without strong contextual justification. Even if intended as a user convenience, it increases the chance of accidental or unauthorized data loss.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Docstrings, printed messages, and command help text are consistently presented only in Chinese, which imposes a language choice on all users. The file does not offer any language selection or indicate that the skill is intentionally region-specific.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The script fetches live index data from an external data provider via akshare, which necessarily involves outbound network requests. While failures are logged, there is no user-facing disclosure here that running the analysis will contact external services and transmit request metadata/system network information.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This call retrieves live A-share quote data through akshare, implying outbound network access. The file prints progress and errors, but it does not clearly disclose to the user that the skill will connect to third-party data sources during execution.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The K-line retrieval function downloads historical stock data from an external provider, which is a network operation covered by the warning requirement for code files. The code handles errors but does not explicitly warn users that analysis depends on remote data access.
- Content