T09 · Insecure Skill Coding Practices
Error
- Location
scripts/analyze.py:372- Finding
Fabricated Financial Metrics Can Drive Investment Recommendations
- Content
View full analysis
- Remediation
View remediation
Security audit
A Stock Analyzer.Bak
Security checks for vulnerabilities and agentic risk
Overview
This A-share trading skill needs Review because it can generate concrete stock trades from default or simulated financial data and can automatically push reports to configured webhooks.
Install only if you are comfortable with a trading assistant that may issue concrete buy, sell, stop-loss, and allocation suggestions. Treat all financial outputs as unverified, disable or remove webhook push unless you explicitly want reports sent outside your machine, and use pinned dependencies in an isolated environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze.py:497- Finding
Advertised Strict Screening Conditions Are Not Enforced
- Content
View full analysis
25: reasons.append(f"✅ 營收同比 +{fin['revenue_growth']:.1f}%") else: reasons.append(f"❌ 營收同比 {fin['revenue_growth']:.1f}%") passed = False if fin['profit_growth'] > 30 and fin['profit_growth_seq'] > 0: reasons.append(f"✅ 凈利潤同比 +{fin['profit_growth']:.1f}%") else: reasons.append(f"❌ 凈利潤不達標") passed = False if fin['roe'] > 15: reasons.append(f"✅ ROE {fin['roe']:.1f}%") else: reasons.append(f"❌ ROE {fin['roe']:.1f}%") passed = False if fin['profit_3y_cagr'] > 20: reasons.append(f"✅ 三年CAGR +{fin['profit_3y_cagr']:.1f}%") # 技術條件（放寬標准） tech = self.check_technical_conditions(symbol) if tech: # 股價在MA50上方或附近（10%以內） price = tech.get('price', 0) ma50 = tech.get('ma50', 0) if tech['above_ma50']: reasons.append(f"✅ 股價站上MA50") elif tech['near_ma50'] or (ma50 > 0 and abs(price - ma50) / ma50 < 0.10): reasons.append(f"✅ 股價接近MA50") else: reasons.append(f"⚠️ 股價偏離MA50") # 成交量 - 放寬標准 if tech['volume_surge']: reasons.append(f"✅ 成交量放大") else: reasons.append(f"⚠️ 成交量一般") else: reasons.append("⚠️ 無K線數據") return { 'passed': passed, 'reasons': reasons, 'financial': fin, 'technical': tech } ``` ### Technical Analysis The Skill documentation claims seven strict selection conditions. The implementation does not enforce several of them: - Failure of the price-v ...[truncated 1912 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:129- Finding
Third-Party Dependencies Are Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (49)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
Outbound webhook communication to Feishu/DingTalk and reading local push configuration are materially different from a pure analysis skill and introduce data egress risk. If not explicitly declared and restricted, the skill could send reports, local metadata, or other sensitive content to external endpoints without clear user understanding or review.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Outbound webhook communication to Feishu/DingTalk and reading local push configuration are materially different from a pure analysis skill and introduce data egress risk. If not explicitly declared and restricted, the skill could send reports, local metadata, or other sensitive content to external endpoints without clear user understanding or review.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code claims to fetch real financial data, but when data is missing or parsing fails it silently substitutes hard-coded favorable defaults or simulated pseudo-random values. In a stock-picking assistant, this can materially falsify investment outputs while appearing authoritative, causing unsafe or deceptive recommendations based on fabricated data rather than actual fundamentals.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 80% confidence
- Finding
The skill advertises capabilities that imply file access, report generation, cron-based execution, and network use, but it does not declare any explicit tool scope or permissions boundaries. This is dangerous because reviewers and users cannot easily determine what the skill is allowed to access or transmit, increasing the risk of overbroad file/network operations and making misuse or unexpected data exfiltration harder to detect.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The natural-language content of the skill forces a single language experience for users, and there is no indication that the user can opt into another language or that the skill is intentionally limited to Chinese-speaking users. Under the stated policy, forcing a specific language without user opt-in is a policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire skill output is presented only in Chinese and is explicitly tailored to the A-share market ('A股分析报告'), with no indication that the user opted into this language or locale. Under the policy, forcing a specific language or locale without user choice or a clearly documented region-specific justification is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The stated rationale of only '今日上涨' does not support the claimed methodology of Minervini trend-template plus seven strict financial conditions. This mismatch is dangerous because it can falsely signal rigor and due diligence, causing users to trust recommendations that may actually be based on weak or incomplete criteria.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The report gives concrete entry ranges, target prices, stop-loss levels, and a 60% position size, which goes beyond descriptive stock analysis into prescriptive trading advice. In an agent skill presented as a stock-screening/analysis assistant, this can mislead users into acting on unverified recommendations and create financial harm, especially because the advice appears authoritative and operationally ready.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
A disclaimer stating the report is 'for reference only' does not neutralize the fact that the content provides precise execution guidance such as buy ranges, targets, stop-losses, and portfolio allocation. This contradiction can create a false sense of legal or safety coverage while still nudging users toward risky financial actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s natural-language content, headings, recommendations, and warnings are all presented exclusively in Chinese, with no indication that the user opted into that language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill claims a strategy based on Minervini trend templates plus seven strict financial conditions, but the displayed rationale only cites generic technical signals like MACD and KDJ crosses. This mismatch can mislead users about the basis, rigor, and trustworthiness of the recommendations, causing them to rely on analysis that is not what the product claims to provide.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The report goes beyond stock screening and gives concrete entry ranges, target prices, stop-loss levels, and explicit position sizing such as '重仓 (60%)'. In a financial-analysis skill, this materially increases the chance that users will treat the output as personalized trading advice, creating consumer-harm, compliance, and suitability risks if the recommendations are inaccurate or inappropriate.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file presents all user-facing content in Chinese, including headings, analysis, recommendations, and risk notices, with no indication that the user opted into this language or that the skill is limited to a Chinese-language audience. This can violate language/locale policy when a skill forces a specific language without user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire report is presented in Chinese, including headings, analysis, recommendations, and risk notes, with no indication that the user opted into this language or that the skill is limited to a Chinese-language context. The policy for this audit flags natural-language locale constraints when a skill forces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The entire report is written in Chinese and is specifically framed as an A-share market report, but the file does not indicate that the user opted into Chinese-language output or that the locale constraint is explicitly documented as a region-specific requirement. Under the policy, forcing a specific language or locale without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The entire report is written in Chinese and specifically framed as an A-share market report, with no indication that the language or locale was selected by the user or that the skill is explicitly limited to this locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The entire report is presented only in Chinese and is specifically framed as an A-share market report, with no indication that the user can choose another language or locale. Under the policy for natural-language violations, forcing a specific language or locale without opt-in should be flagged unless the regional constraint is clearly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The entire skill output is presented in Chinese, including headings, recommendations, and risk notes, with no indication that the user opted into this language or that the skill is intentionally limited to a Chinese-speaking context. This is a natural-language locale policy issue because the file reflects a fixed language choice rather than an offered preference or clearly justified regional constraint.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script generates a stock analysis report and then automatically calls
_push_report(report), which imports a separate pusher module and transmits report content externally. Even though only the first 30 non-empty lines are sent, this is still an undisclosed outbound data flow inconsistent with a local stock analysis tool and can leak potentially sensitive analysis results or user-derived content without consent.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Report content is sent through a push mechanism without any user approval, notice, or safety interstitial. Because the report may contain generated recommendations, market views, or environment-specific content, automatic transmission creates a privacy and data-governance risk and could be abused by a malicious or misconfigured pusher backend.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and user-facing messages indicate the skill forces Chinese-language interaction/documentation. Under the policy, language constraints should either be optional for the user or clearly documented as a justified regional limitation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The Feishu integration performs external network transmission of report content to a webhook URL, which is a genuine data egress point. In context, the feature is expected behavior for a push module, but it still becomes security-relevant because sensitive analytical output can be sent outside the local trust boundary if the webhook is compromised, misdirected, or enabled without sufficient user awareness.
- Content
python } } response = requests.post(webhook, json=card, timeout=10) if response.status_code == 200: print("✅ 飞书推送成功")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code sends report contents to a configured Feishu webhook without any explicit user-facing notice, confirmation, or data classification check at send time. Because reports may contain sensitive trading research, account-related context, or proprietary analysis, silent transmission to an external SaaS endpoint creates a real confidentiality and privacy risk if users are unaware or the webhook is misconfigured.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The DingTalk integration also transmits report content over the network to an external webhook, creating a clear exfiltration path outside the local environment. Although this appears intended rather than malicious, the stock-analysis context makes the transmitted content potentially commercially sensitive, increasing the confidentiality impact of accidental or unauthorized delivery.
- Content
python } } response = requests.post(webhook, json=data, timeout=10) if response.status_code == 200: print("✅ 钉钉推送成功")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code posts report contents to a DingTalk webhook without any user-visible warning that analysis output is being transmitted to an external messaging service. In a stock-analysis skill, reports may include sensitive investment signals or proprietary screening results, so undisclosed external delivery can lead to unintended data exposure.
- Content
Static analysis
No suspicious patterns detected.