T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/prune.py:313- Finding
Configurable Unauthenticated Plaintext MCP Endpoint Exposes Factor Data and Internal Network Access
- Content
View full analysis
- Remediation
View remediation
Security audit
factor-prune
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its finance factor-pruning purpose, but it can send full factor formulas to any user-supplied MCP service over unauthenticated HTTP.
Install only if you intend to run QuantAll locally or against a trusted MCP endpoint. Do not pass a remote --mcp-url unless you are comfortable sending factor formulas and output-path metadata to that service; prefer a locked dependency environment for QuantAll and Python packages.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Third-Party QuantAll Startup Code Is Executed Without Package Artifact Integrity Verification
- Content
View full analysis
/scripts/.venv/Scripts/python.exe- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (40)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Random simulation and baseline-generation utilities are not inherently malicious, but when bundled into a skill that claims to only prune factors they create a misleading trust boundary. Users and orchestrators may authorize the skill for one narrow purpose while it actually performs broader analytics and file generation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Random simulation and baseline-generation utilities are not inherently malicious, but when bundled into a skill that claims to only prune factors they create a misleading trust boundary. Users and orchestrators may authorize the skill for one narrow purpose while it actually performs broader analytics and file generation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Random simulation and baseline-generation utilities are not inherently malicious, but when bundled into a skill that claims to only prune factors they create a misleading trust boundary. Users and orchestrators may authorize the skill for one narrow purpose while it actually performs broader analytics and file generation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Random simulation and baseline-generation utilities are not inherently malicious, but when bundled into a skill that claims to only prune factors they create a misleading trust boundary. Users and orchestrators may authorize the skill for one narrow purpose while it actually performs broader analytics and file generation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Random simulation and baseline-generation utilities are not inherently malicious, but when bundled into a skill that claims to only prune factors they create a misleading trust boundary. Users and orchestrators may authorize the skill for one narrow purpose while it actually performs broader analytics and file generation.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `facotr-Qlib_alpha158.xlsx` | 158 | Qlib Alpha158 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `facotr-Qlib_alpha360.xlsx` | 360 | Qlib Alpha360 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `factor-Alpha101.xlsx` | 101 | WorldQuant Alpha101 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `factor-GTJA_Alpha191.xlsx` | 191 | 国泰君安 Alpha191 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `factor-stock_daily.xlsx` | 12 | 基础量价/估值因子 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `factor-stock_report.xlsx` | 105 | 财务质量/成长/偿债因子 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `factor-TA_Indicators.xlsx` | 85 | TA-Lib 技术指标 |
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
text out = 100*(1 - rolling_imax(ah, 20))</t></si><si><t>TA_AROON_DOWN20</t></si><si><t>ah = d['high']*d['adj_factor']; al = d['low']*d['adj_factor'] out = 100*(1 - rolling_imin(al, 20))</t></si><si><t>TA_AROON_OSC20</t></si><si><t>ah = d['high']*d['adj_factor']; al = d['low']*d['adj_factor'] out = 100*(1-rolling_imax(ah,20)) - 100*(1-rolling_imin(al,20))</t></si><si><t>TA_CMO14</t></si><si><t>ac = d['close']*d['adj_factor'] dd = ac.diff(); su = dd.clip(lower=0).rolling(14).sum(); sd = (-dd).clip(lower=0).rolling(14).sum() out = (su-sd)/(su+sd+1e-12)*100</t></si><si><t>TA_CMOU14</t></si><si><t>ac = d['close']*d['adj_factor'] dd = ac.diff(); up = dd.clip(lower=0); dn = (-dd).clip(lower=0) out = (up-dn)/(dd.abs()+1e-12)*100</t></si><si><t>TA_BOP</t></si><si><t>ac = d['close']*d['adj_factor']; ah = d['high']*d['adj_factor']; al = d['low']*d['adj_factor']; ao = d['open']*d['adj_factor']
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
python sub.add_parser("finalize", help="Generate final output xlsx") # reset p_reset = sub.add_parser("reset", help="Clear state (corr matrix cache kept by default)") p_reset.add_argument("--clear-matrix", dest="keep_matrix", action="store_false", default=True, help="Also clear the cached correlation matrix")
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares capabilities that include reading/writing local files and interacting with a networked QuantAll service, but the manifest does not constrain or document tool scope. In an agent setting, missing permission boundaries increases the risk of over-broad execution, unintended file modification, or unsolicited service interaction beyond the user’s expectation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Broad trigger keywords without clear exclusions can cause the skill to activate in contexts the user did not intend, especially for generic terms like factor selection or de-correlation. In an automated agent environment, over-triggering increases the chance of unnecessary file/network operations and accidental data exposure.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest says the skill only outputs a pruned factor list, but the documentation advertises additional analysis tooling. This inconsistency weakens security review and user consent because the actual data handling and output surface are broader than represented.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The version notes state that only factor-pruning functionality remains, yet the retained files include startup infrastructure and non-pruning utilities. This creates a misleading inventory of capabilities and may cause reviewers to underestimate execution, network, or process-management behavior present in the package.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This manifest-style JSON maps all field names to Chinese text labels, with no indication that the skill is China-specific or that users may choose another language. Under the natural-language policy rule, hard-coding a single locale without opt-in or justification can violate language/locale policy expectations.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest says the factor-prune skill is bounded to outputting a curated factor list and explicitly excludes other downstream analysis. In contrast, this file computes per-factor heatmap evaluations, rank-IC estimates, decile spreads, and validity summaries, then renders visualizations and exports a summary workbook, which is a broader analytical product than the declared prune-only output.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes greedy forward selection and correlation-based redundancy removal over factor effectiveness metrics. This code instead creates a QuantAll layer, moves factor/return data onto X and Y axes, assigns weights, calls a heat_map tool, and derives metrics from density matrices—behavior aligned with factor visualization analysis rather than the stated prune loop.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The docstring explicitly states that rendering uses English labels to avoid missing CJK fonts, which imposes a language choice rather than offering user opt-in or configuration. This is a natural-language locale policy issue because the file forces a specific language without presenting alternatives.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest says this skill's boundary is to output only a de-redundant '精选因子清单', explicitly excluding downstream analysis. This file instead performs exhaustive pairwise evaluation of all factor combinations, computes joint predictive metrics, and renders new PNG/XLSX analytical artifacts, which is a broader analysis workflow than simple factor pruning output.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The declared purpose is greedy forward selection and de-correlation pruning of effective factors after stock-factor output. This code instead enumerates every unordered factor pair, calls QuantAll visualization/heatmap tooling for each pair, and generates comparative visual diagnostics and ranking tables, which is an exploratory research capability rather than an obvious requirement for producing a pruned factor list.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This Python code establishes a client connection and sends code payloads through multiple
call_tooloperations, which is a network/data-transmission behavior covered by the missing-warning rule for code files. Although the file has a brief docstring, it does not clearly warn users that local factor data and generated expressions will be transmitted to an external service.- Content
Static analysis
No suspicious patterns detected.