A股新债申购助手

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:59 PM UTC
• Version: 1.0.6

Overview

The skill mostly matches its stock-reminder purpose, but it requires extra Feishu table credentials that the code does not use and makes overstated safety/compliance claims.

Review carefully before installing. Use only a narrowly scoped Feishu webhook unless table-writing functionality is actually added, avoid granting table read/write tokens for the current code, keep any .env file out of version control, and treat the certification and 100% accuracy/safety claims as unsupported marketing rather than a security guarantee.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: _meta.json:31

Finding

Unnecessary Collection of Privileged Feishu Credentials

Content

View full analysis

Vulnerability Details

File Location: _meta.json:31-48; related declarations in SKILL.md:27-28, .env:9-16, and scripts/index.js:21-23
Vulnerability Type: Violation of least privilege through unnecessary credential requirements
Risk Level: Medium

The Skill requires Feishu access credentials and table identifiers despite not implementing any Feishu table operations.

Vulnerable Code

_meta.json:31-48:

json

"feishuAccessToken": {
  "type": "string",
  "label": "Feishu AccessToken",
  "required": true,
  "description": "Application access credential obtained from the Feishu Open Platform"
},
"feishuAppToken": {
  "type": "string",
  "label": "Feishu multidimensional table AppToken",
  "required": true,
  "description": "Feishu table App Token"
},
"feishuTableId": {
  "type": "string",
  "label": "Feishu table ID",
  "required": true,
  "description": "Feishu table Table ID"
}

scripts/index.js:21-23:

javascript

feishuAccessToken: process.env.FEISHU_ACCESS_TOKEN,
feishuAppToken: process.env.FEISHU_APP_TOKEN,
feishuTableId: process.env.FEISHU_TABLE_ID,

.env:9-16:

dotenv

FEISHU_ACCESS_TOKEN=t-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
FEISHU_APP_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
FEISHU_TABLE_ID=tblxxxxxxxxxxxxxxxx

Technical Analysis

The configuration schema marks the Feishu access token, application token, and table ID as required. The documentation also tells users to grant multidimensional-table read/write permission.

However, the executable implementation only sends a message through CONFIG.feishuWebhook. The three table-related values are loaded into memory but are never used to authenticate to a Feishu table API or perform table operations. Consequently, requiring these credentials exceeds the minimum privileges necessary for the implemented webhook notification functionality.

This unnecessarily expands the credential e ...[truncated 2230 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove feishuAccessToken, feishuAppToken, and feishuTableId from the required configuration schema until table integration is actually implemented.
2. Remove the corresponding environment-variable examples and documentation requesting multidimensional-table read/write permission.
3. Retain only FEISHU_WEBHOOK for the currently implemented notification behavior.
4. If table functionality is added later, request the narrowest available Feishu scopes and make table credentials optional unless that functionality is enabled.
5. Store credentials through the platform's secret manager rather than a project-local .env file in production.
6. Prevent secrets from appearing in logs, exception output, diagnostics, or telemetry, and ensure .env is excluded from version control and package publication.
7. Document credential purpose, scope, lifetime, rotation, and revocation procedures.
8. Add automated tests that verify disabled features do not require or load unrelated credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .env (reported line 2)May include surrounding context.

text

# stock-subscribe-helper 合规版环境变量配置
# 复制此文件为 .env 并填写实际值

# ==================== 飞书配置 ====================
# 飞书机器人Webhook（从飞书机器人设置获取）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

2. 配置环境变量

bash

cp .env.example .env
# 编辑.env文件，填写你的配置

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

配置环境

bash

cp .env.example .env
# 编辑.env文件填写配置

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The markdown explains how to configure Feishu webhook, access token, and table identifiers, and describes automatic message sending and table updates. However, it does not include any user-facing warning that running the skill will transmit subscription-related data to third-party Feishu services and may write/update records there.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation instructs users to configure Feishu webhooks, access tokens, and table identifiers, and describes automatic table writes and message pushes, but it does not clearly warn that data will be transmitted to a third-party service or explain safe handling of these credentials. This creates a realistic risk of users exposing sensitive tokens, misconfiguring outbound data flows, or using the skill without understanding the privacy and security implications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The package description is written entirely in Chinese and explicitly targets 'A股' workflows, indicating a Chinese-language/China-market constraint without any indication of user choice or opt-in. Under the policy rule for natural-language locale constraints, this is a documented language/locale restriction that is not presented as optional in the file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file header and later console output assert absolute data accuracy and compliance/certification status. In practice, the script only fetches remote data, parses it, and performs basic URL validation; there is no code that verifies data correctness, proves certification, or checks compliance status, so the documentation and status messaging overstate what the code actually guarantees.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script explicitly formats time using the zh-CN locale, and its user-facing logs/messages are written only in Chinese. This imposes a specific language/locale on users without any opt-in, fallback, or documented region-specific constraint, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The section header and function docstrings describe the data fetch module as using '官方API' and specifically label both EastMoney and Jisilu retrieval as official API usage. However, the code only hardcodes a Jisilu data endpoint and performs a generic HTTP GET; the surrounding documentation does not substantiate that this source is official in the same way as EastMoney, creating an intent/documentation mismatch about provenance and trust level.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/index.js (reported line 118)May include surrounding context.

js

params: CONFIG.eastmoney.params,
      headers: {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
        'Referer': 'https://data.eastmoney.com/'
      },
      timeout: 15000
    });

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documentation appears to force a specific language/locale for all user-facing instructions. Under the policy, language restrictions should either provide user choice or clearly document a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The natural-language interface and instructions are entirely in Chinese, with no indication that users may choose another language. Under the stated policy, forcing a specific language without user opt-in can be a locale/language policy violation unless clearly justified and documented.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

Using a caret range for axios allows future minor/patch releases to be installed without explicit review, which increases supply-chain risk and can unexpectedly introduce vulnerable or breaking versions. This is more concerning here because axios already has known advisories in some releases, so lack of exact pinning reduces confidence in what version will actually run.

Content

Scanner excerpt · package.json (reported line 36)May include surrounding context.

json

"node": ">=16.0.0"
  },
  "dependencies": {
    "axios": "^1.6.0",
    "date-fns": "^3.0.0"
  },
  "devDependencies": {

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

The caret range for date-fns permits automatic drift to newer releases, which is a classic supply-chain hygiene issue even if no specific exploit is shown here. While the immediate impact is lower than a network-facing library, unpinned dependencies still reduce build reproducibility and version assurance.

Content

Scanner excerpt · package.json (reported line 37)May include surrounding context.

json

},
  "dependencies": {
    "axios": "^1.6.0",
    "date-fns": "^3.0.0"
  },
  "devDependencies": {
    "eslint": "^8.56.0",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 83% confidence

Finding

Unpinned dev dependency versions can introduce malicious or vulnerable tooling into development or CI environments. Although eslint is not normally shipped to production, compromised tooling can still affect code quality checks, CI secrets, or developer machines.

Content

Scanner excerpt · package.json (reported line 40)May include surrounding context.

json

"date-fns": "^3.0.0"
  },
  "devDependencies": {
    "eslint": "^8.56.0",
    "prettier": "^3.2.5"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 83% confidence

Finding

Allowing prettier to float via a caret range creates non-reproducible development environments and modest supply-chain exposure. The production impact is usually limited, but compromised formatting tools can still affect developer workstations or CI pipelines.

Content

Scanner excerpt · package.json (reported line 41)May include surrounding context.

json

},
  "devDependencies": {
    "eslint": "^8.56.0",
    "prettier": "^3.2.5"
  }
}

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/index.js:21

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: .env:9