T08 · Insecure Dependencies
Warning
- Location
SKILL.md:10- Finding
Unpinned Third-Party Dependencies Create a Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Human Stock Helper
Security checks for vulnerabilities and agentic risk
Overview
This stock-helper is mostly purpose-aligned, but it needs review because it stores and changes sensitive trading records in a hard-coded local path without clear user control.
Review before installing. Use it only if you are comfortable with local plaintext storage of portfolio and trade history, and change the storage path to a private application directory before recording real positions. Avoid sending account-like details, holdings, or trading plans through Tavily unless you consent to third-party processing. Treat all buy/sell/stop-loss outputs as non-professional analysis, not financial advice.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
position_manager.py:14- Finding
Position Manager Uses a Hard-Coded External Path and Plaintext Financial Storage
- Content
View full analysis
dict: """加载 JSON 文件""" if not filepath.exists(): return {"version": "1.0", "positions": [], "summary": {}} with open(filepath, 'r', encoding='utf-8') as f: return json.load(f) def save_json(filepath: Path, data: dict): """保存 JSON 文件""" with open(filepath, 'w', encoding='utf-8') as f: json.dump(data, f, ensure_ascii=False, indent=2) ``` ### Technical Analysis The position manager reads and overwrites portfolio and trade records at a developer-specific absolute path outside the project directory. The user cannot select or approve the storage location through the documented interface. Records are written directly as plaintext JSON. The code does not enforce restrictive file permissions, verify directory ownership, prevent symbolic-link redirection, or use an atomic write-and-rename sequence. Directly opening the target with write mode truncates the existing file before serialization completes, so interruption or concurrent execution can corrupt the records. Because the path is fixed, every user running this code attempts to access the same developer-specific location. If that path exists in the runtime environment, the program may read or overwrite records belonging to another workspace. If a local attacker can control a component of the path or substitute the destination with a symbolic link, writes may be redirected to another file writable by the invoking account. ### Attack Path 1. The Skill is invoked through an operation that adds, removes, or updates a position. 2. The script se ...[truncated 1158 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
strategy_manager.py:16- Finding
Strategy Manager Uses a Hard-Coded External Path and Plaintext Financial Storage
- Content
View full analysis
dict: """加载 JSON 文件""" if not filepath.exists(): return {"version": "1.0", "strategies": []} if "strategies" in filepath.name else {"version": "1.0", "executions": []} with open(filepath, 'r', encoding='utf-8') as f: return json.load(f) def save_json(filepath: Path, data: dict): """保存 JSON 文件""" with open(filepath, 'w', encoding='utf-8') as f: json.dump(data, f, ensure_ascii=False, indent=2) ``` ### Technical Analysis The strategy manager accesses strategy definitions, execution history, and portfolio information through a developer-specific absolute path. This crosses the Skill package boundary without a configurable or explicitly approved destination. The files are read and written as plaintext JSON without permission enforcement, ownership verification, symbolic-link defenses, file locking, or atomic replacement. Strategy and execution records may contain sensitive trading behavior and free-form market notes. Direct write mode also truncates an existing file before a complete replacement is guaranteed. The implementation therefore creates confidentiality and integrity risks when the fixed directory is shared, pre-existing, attacker-controlled, or concurrently accessed. ### Attack Path 1. A user invokes an operation such as `execute` or `close`. 2. The script automatically accesses the fixed external memory directory. 3. A local attacker with control over that directory or its filenames supplies manipulated JSON or red ...[truncated 962 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This is a second description-behavior mismatch covering undeclared persistent reads and writes to multiple JSON files while overstating technical-analysis functionality. Such discrepancies undermine informed consent and make it easier for a skill to collect or modify sensitive financial records under the guise of benign analysis.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
This is a second description-behavior mismatch covering undeclared persistent reads and writes to multiple JSON files while overstating technical-analysis functionality. Such discrepancies undermine informed consent and make it easier for a skill to collect or modify sensitive financial records under the guise of benign analysis.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill advertises capabilities that include persistent local file access but does not declare any tool scope or permission boundaries. In practice, this makes it harder for users or the host platform to understand that the skill can read and write local state, increasing the risk of unintended data access or modification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill documents Tavily search and research calls but does not inform users that their queries may be sent to a third-party service. User prompts may include portfolio holdings, trade intentions, or proprietary strategy details, so undisclosed transmission creates a meaningful privacy and confidentiality risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly offers to record trading activity and maintain positions, but it does not warn users that this information will be stored persistently. Because trading history and portfolio data are financially sensitive, silent retention can expose private behavior, strategy, and account-like information to later reads or unintended sharing.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script persists stock positions and trade history to a hard-coded absolute path under a local desktop directory. This creates unnecessary long-lived sensitive financial records, can write outside an expected skill sandbox, and may expose or overwrite user data if the path is shared, synced, or accessible to other local processes.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill does more than analyze or remind: it creates and mutates durable portfolio and trade records, effectively acting as a stateful portfolio manager. This scope expansion is risky because users may invoke what they believe is advisory tooling while it silently changes persistent financial state, increasing the chance of unintended actions and privacy exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The remove operation marks positions as sold and can record a sell transaction immediately, without any confirmation, undo flow, or safeguard. For financial records, a mistaken command or malformed automation input can irreversibly alter portfolio history and downstream decisions based on that history.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Natural-language strings throughout the file, including docstrings, report labels, usage examples, and recommendations, are presented only in Chinese. The file does not offer user opt-in for language selection or explain that the tool is intentionally restricted to a Chinese-speaking context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script generates concrete trading actions such as reducing positions, moving stop losses, and exiting positions, but it does not present any user-facing warning that the output is not financial advice and may lead to monetary loss if followed blindly. In a trading context, prescriptive recommendations increase the chance that users treat the tool as authoritative, which can cause direct financial harm.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The module description and all user-facing CLI output are written in Chinese, which imposes a single language on users without any opt-in or alternative locale. The policy for natural-language violations applies to all file types, including code files with user-facing strings and comments.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description is written as an instruction to provide the service in Chinese and the rest of the skill content is consistently Chinese-only, with no indication that users may choose another language. This can violate language/locale policy when a skill imposes a specific language without opt-in or documented regional justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description is written only in Chinese and specifically targets A-share trading, which implies a fixed language/locale context without stating that users can choose another language. The policy requires flagging language or locale constraints when they are imposed without explicit user opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JSON file includes a natural-language string in Chinese ("示例数据 - 请替换为您的实际持仓") with no indication that the skill is region-specific or that users may choose another language. The policy for this category flags language or locale constraints when they are imposed without user opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module title, description, help text, and user-facing messages are written in Chinese, with no indication that users can choose another language. This creates a language policy issue when the skill assumes a fixed locale rather than offering or documenting user choice.
- Content
Static analysis
No suspicious patterns detected.