Security audit

Trade Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This skill does not show hidden network access, persistence, or credential theft, but it overstates important capabilities and ships broken analysis code for sensitive trading records.

Review this skill before installing. It appears local and purpose-focused, but it should be fixed before use: Excel support is overstated, the analyzer currently cannot run due to a syntax error, and generated Markdown reports should not be treated as trusted financial advice or rendered unsafely from untrusted records.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: analyzer.py:421
Finding: Fatal Syntax Error Causes Complete Analyzer Denial of Service
Content: View full analysis
Vulnerability Details

File Location: analyzer.py, lines 421-424
Vulnerability Type: Application-level denial of service caused by invalid string quoting
Risk Level: High

Vulnerable Code

python
else: analysis.append("- ⚠️ **盈亏比偏低**：存在"赚小亏大"问题，需要优化卖点或加强止损") if win_rate > 60 and pl_ratio < 1.5: analysis.append("- 💡 **核心问题**：高胜率但盈亏比不足，典型"卖飞"型选手，需要学会让利润奔跑")

Technical Analysis

The double quotation marks surrounding phrases inside both string literals are not escaped. Python therefore interprets the inner quotation marks as the end of each string, leaving unexpected tokens after it.

Python parses an entire module before executing any of its functions. Consequently, this syntax error prevents analyzer.py from being imported, invoked from the command line, or used through the documented analyze_file and analyze_text APIs. The failure is unconditional and does not require a specially crafted input file.

Attack Path

A user or integrating application imports analyzer.py or runs it from the command line.

The Python interpreter parses the module.

Parsing reaches line 421 and encounters the malformed string literal.

Python raises a SyntaxError before any analysis function can run.

The requested trade analysis becomes completely unavailable.

Impact Assessment

The issue causes complete loss of availability for the analyzer. An attacker does not gain operating-system privileges, access to files, code-execution capability, or access to confidential data. However, any service or automated workflow that depends on importing this module will fail until the source is corrected. If such a workflow does not isolate failures, the error may also interrupt the surrounding job or service.
Remediation: View remediation
Remediation Suggestions

Use single-quoted outer strings or escape the embedded double quotation marks:

python
else: analysis.append('- ⚠️ **Low profit/loss ratio**: The strategy has a "small gains, large losses" pattern and requires better exits or stricter stop-loss controls.') if win_rate > 60 and pl_ratio < 1.5: analysis.append('- 💡 **Primary issue**: The win rate is high but the profit/loss ratio is insufficient, indicating premature exits.')

Add automated syntax and import checks to continuous integration:

bash
python -m py_compile analyzer.py python -c "import analyzer"

Also add tests that exercise analyze_file, analyze_text, and each report-generation branch so malformed literals and other import-blocking defects are detected before release.

T09 · Insecure Skill Coding Practices

Warning

Location: analyzer.py:320
Finding: Unescaped Trade Data Allows Markdown Report Injection
Content: View full analysis
Vulnerability Details

File Location: analyzer.py, input assignments at lines 93-99 and report sink at lines 320-322
Vulnerability Type: Improper neutralization of untrusted data in Markdown output
Risk Level: Medium

Vulnerable Code

python
if col_date: record.date = row.get(col_date, '') if col_stock: record.stock = row.get(col_stock, '') if col_strategy: record.strategy = row.get(col_strategy, '') if col_sell_reason: record.sell_reason = row.get(col_sell_reason, '')

python
# 添加前10笔交易详情 for i, r in enumerate(self.records[:10], 1): report += f"| {r.date} | {r.stock} | {r.strategy} | {r.return_rate:+.2f}% | {r.sell_reason} |\n"

A second unescaped output path exists at lines 450-452:

python
main_strategy = max(set(strategies), key=strategies.count) strategy_pct = strategies.count(main_strategy) / len(strategies) * 100 profiles.append(f"1. **主要策略**：{main_strategy}（占比 {strategy_pct:.1f}%）")

Technical Analysis

Fields read from an attacker-controlled CSV or text record are stored without normalization and interpolated directly into the generated Markdown report. The implementation does not escape table delimiters, line breaks, Markdown links, image syntax, or raw HTML.

An attacker can therefore supply values containing pipe characters or newlines to create additional table cells, rows, or report sections. Where the report is rendered by a Markdown engine that permits raw HTML or remote images, crafted input may also cause the renderer or viewing client to request an attacker-controlled remote resource. That behavior depends on the downstream renderer and is not initiated directly by this Python module.

The same problem affects the behavior-profile section because the most common attacker-controlled strategy value is inserted directly into prose at line 452.

Attack Path

An attacker creates a CSV or text trade record containing ...[truncated 1442 chars]
Remediation: View remediation
Remediation Suggestions

Apply context-specific Markdown escaping to every untrusted field before interpolation. At minimum:

Replace line breaks with spaces.

Escape backslashes, pipe characters, backticks, brackets, and other Markdown control characters.

Remove or encode raw HTML.

Enforce reasonable field-length limits.

Treat CSV and text records as untrusted regardless of their origin.

Example hardening helper:

python
def escape_markdown_table(value: object) -> str: text = str(value or "") text = text.replace("\r", " ").replace("\n", " ") text = text.replace("\\", "\\\\") text = text.replace("|", "\\|") text = text.replace("`", "\\`") text = text.replace("<", "&lt;").replace(">", "&gt;") return text

Apply it at every report sink:

python
report += ( f"| {escape_markdown_table(r.date)} " f"| {escape_markdown_table(r.stock)} " f"| {escape_markdown_table(r.strategy)} " f"| {r.return_rate:+.2f}% " f"| {escape_markdown_table(r.sell_reason)} |\n" )

Configure the downstream Markdown renderer to reject raw HTML, scripts, embedded objects, and automatic remote-resource loading. Add tests using pipe characters, multiline values, links, images, raw HTML, and oversized fields to verify that input remains inert text.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill claims Excel support and broad, deep analysis capabilities that are not actually implemented. This is dangerous because users may rely on incomplete or incorrect parsing and analytics for financial decisions, and unsupported files may be misread as plain text, producing misleading reports without clear failure signals.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README is written entirely in Chinese and presents all usage, examples, and data-format guidance only in Chinese, which imposes a specific language/locale on users. Under the policy, this is a natural-language locale constraint and there is no visible opt-in, alternative language option, or justification that the skill is region-specific.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest says this skill supports CSV, Excel, and text input, implying native handling of Excel files. However, the README explicitly says only CSV and text are supported and that Excel (.xlsx) requires the separate document-pro skill, which contradicts the stated capability.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description is written as a Chinese-language skill description and does not indicate that the user may choose another language or locale for interaction or output. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The activation examples include broad natural-language phrases such as "分析我的交易记录", "帮我复盘交割单", and especially "评估交易策略", which could overlap with ordinary conversation rather than a narrowly defined invocation. The section does not provide exclusion conditions or negative examples to clarify when the skill should not activate.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This Python file contains extensive user-facing output, comments, and messages in Chinese, including the generated report, error messages, and CLI usage text, but it does not provide any language selection or explain that the skill is intentionally limited to Chinese-speaking users. Under the policy for natural-language violations, forcing a specific language without user opt-in is in scope for all file types.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill description explicitly says it supports CSV, Excel, and text inputs, but this module implements CSV parsing and a fallback plain-text reader only. There is no Excel parser or any spreadsheet library usage, so the actual behavior falls short of the advertised capability.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation for _parse_records describes '智能列名映射' and _find_column as finding a matching column name, but when no match is found the code returns headers[0]. That behavior can silently map unrelated data into fields, which contradicts the stated intent of semantic matching.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tp4

Natural-Language Policy Violations

Intent-Code Divergence

Undeclared Tool Scope

Natural-Language Policy Violations

Vague Triggers

Natural-Language Policy Violations

Description-Behavior Mismatch

Intent-Code Divergence

Static analysis