T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/sector_rank.py:19- Finding
Financial market data retrieved over unencrypted HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
Eastmoney Stock.Bak
Security checks for vulnerabilities and agentic risk
Overview
This stock-data skill has no signs of system compromise, but it materially misrepresents financial data sources and can present hardcoded or advisory market output as current analysis.
Review carefully before installing. Use it only as an experimental market-data helper, not for investment decisions. Confirm any quote, ranking, or recommendation against a trusted financial source, because the package mixes providers, uses plaintext HTTP in some places, and includes static advisory content.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
sector_rank.py:12- Finding
Duplicate sector-ranking implementation uses unencrypted HTTP
- Content
View full analysis
- Remediation
View remediation
other
Note
- Location
hot_sectors_today.py:7- Finding
Hardcoded market claims and portfolio recommendations are presented as current analysis
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (23)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared capability promises Eastmoney-based quote fields like price change and volume, but the observed behavior reportedly uses a different source and does not implement those fields completely. This discrepancy can mislead both users and security reviewers about what data is retrieved and how trustworthy or complete the result is.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared capability promises Eastmoney-based quote fields like price change and volume, but the observed behavior reportedly uses a different source and does not implement those fields completely. This discrepancy can mislead both users and security reviewers about what data is retrieved and how trustworthy or complete the result is.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared capability promises Eastmoney-based quote fields like price change and volume, but the observed behavior reportedly uses a different source and does not implement those fields completely. This discrepancy can mislead both users and security reviewers about what data is retrieved and how trustworthy or complete the result is.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared capability promises Eastmoney-based quote fields like price change and volume, but the observed behavior reportedly uses a different source and does not implement those fields completely. This discrepancy can mislead both users and security reviewers about what data is retrieved and how trustworthy or complete the result is.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared capability promises Eastmoney-based quote fields like price change and volume, but the observed behavior reportedly uses a different source and does not implement those fields completely. This discrepancy can mislead both users and security reviewers about what data is retrieved and how trustworthy or complete the result is.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The declared capability promises Eastmoney-based quote fields like price change and volume, but the observed behavior reportedly uses a different source and does not implement those fields completely. This discrepancy can mislead both users and security reviewers about what data is retrieved and how trustworthy or complete the result is.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared capability promises Eastmoney-based quote fields like price change and volume, but the observed behavior reportedly uses a different source and does not implement those fields completely. This discrepancy can mislead both users and security reviewers about what data is retrieved and how trustworthy or complete the result is.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill advertises querying Eastmoney stock data, but this file instead prints fully hardcoded sector rankings, stock picks, prices, and even portfolio allocation advice. In a financial-analysis context, presenting fabricated or stale data as market information can mislead users into making real investment decisions based on false premises, which materially increases risk.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill advertises network-backed stock lookups but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, missing scope boundaries can let the runtime or reviewers underestimate what external access the skill may require, increasing the risk of unintended network use or privilege expansion.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Overly broad invocation examples such as ordinary stock-related conversation make trigger boundaries ambiguous, which can cause the skill to activate unexpectedly in normal chat. In a networked finance skill, accidental triggering can lead to unintended external requests, confusing responses, or hidden delegation to behavior the user did not clearly invoke.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata claims it queries Eastmoney stock data, but the implementation actually requests data from Sina Finance. This is a supply-chain/integrity issue: users or downstream agents may rely on the declared data source for trust, licensing, formatting, or compliance reasons, yet the code silently uses a different provider. In a finance-related skill, this mismatch increases risk because analysis and decisions may be made based on unexpected or unapproved market data.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The module docstring claims to use the Sina Finance API, but no API call occurs and the output is entirely local hardcoded content. This mismatch is dangerous because it misrepresents provenance and recency of financial information, which is especially risky in a stock-related skill where users expect current data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file’s natural-language content, including the module description, headings, stock commentary, and risk notices, is entirely in Chinese with no indication that the user can opt into another language. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill advertises stock-data querying behavior but actually emits hardcoded sectors and stock picks, creating a semantic integrity issue. In a financial-analysis context, users may rely on stale or fabricated output as if it were live market data, which can mislead decisions and undermine trust in the agent.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring and function description claim to obtain current A-share hot sectors and related stocks, but the implementation does not fetch any data and instead returns static content. This mismatch is dangerous because it creates a false sense of freshness and authenticity, especially in a stock-analysis skill where users may rely on implied recency.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This Python file presents all user-facing text in Chinese, including the title, analysis, allocation guidance, and risk notices. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest says this skill queries 东方财富 (Eastmoney) stock data, but the module docstring, function docstring, and request URL all show the implementation actually fetches data from 新浪财经 at hq.sinajs.cn. This is a semantic mismatch in data source and behavior, not just an implementation detail, because the skill is branded and described as Eastmoney-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This Python file contains user-facing docstrings and printed output entirely in Chinese, including status messages, analysis text, and recommendations. Because the skill does not provide any user opt-in, language selection, or justification that it is intended only for a Chinese-language audience, it conflicts with the language/locale policy criteria.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code exceeds the stated stock-data querying purpose by outputting prescriptive trading guidance such as recommending attention to hot sectors, selecting leading stocks, and setting stop-losses. In a financial skill, this is dangerous because users may rely on the generated recommendations as investment advice without suitability checks, disclosures, or regulatory controls, increasing risk of financial harm and compliance issues.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This file contains natural-language strings in Chinese in the module docstring, function docstring, and all user-facing print messages. The skill does not provide any user opt-in, language selection, or justification that it is intentionally limited to Chinese users or a China-specific environment, which creates a language/locale policy concern.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest says this skill queries 东方财富股票数据, which implies Eastmoney as the data source. However, the implementation sends the request to hq.sinajs.cn with a finance.sina.com.cn referer, so the actual external service used is Sina rather than Eastmoney.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The package description is written only in Chinese ("东方财富股票数据查询"), which can constitute a language-policy issue if the skill is expected to be generally usable but does not offer any language choice or explain a locale restriction. There is no indication in this file that the skill is region-specific or that users opt into a Chinese-only experience.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code file performs outbound network requests to Eastmoney endpoints using requests.get, which transmits request metadata such as headers and the user's network-originating context. While the module docstring notes that it uses the Eastmoney API, there is no explicit user-facing warning, confirmation, or runtime disclosure around the external network access.
- Content
Static analysis
No suspicious patterns detected.