T08 · Insecure Dependencies
Warning
- Location
INSTALL_GUIDE.md:47- Finding
Unpinned Third-Party Dependencies Handle Account Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Panda Data Skill
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent financial data wrapper, but its setup asks users to expose account credentials to an assistant and relies on unpinned external packages that handle those credentials.
Install only in a dedicated virtual environment, pin and review panda_data and panda-data-tools before use, and do not paste your PandaAI username or password into chat. Prefer securely set environment variables or a restricted local secret store, and avoid placing .env files where unrelated projects or assistants can discover them.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md 大模型或脚本实际调数据时，需要： | 组件 | 作用 | |------|--------------------------------------------------------------------------------------------------------------| | **panda_data** | PandaAI 官方 Python SDK（一般 `pip install panda_data` | | **panda-data-tools** | 本项目的 PyPI 包名，`pip install panda-data-tools`提供 `panda_tools` 模块（`ToolRegistry`、`CredentialManager`、各 tool 封装） |
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The guide explicitly tells users to provide their PandaAI username and password to the assistant for configuration. Even though it says to do so 'under security preconditions' and not leak them, asking users to hand credentials to an LLM-facing assistant creates a real risk of inadvertent disclosure through logs, prompt history, third-party processing, or misuse by the agent runtime. In the context of a financial data skill, this is more dangerous because the credentials authenticate access to a user account and may expose paid data access or account-linked activity.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation instructs users to give credentials directly to the assistant so it can write configuration. This is a true secret-handling flaw because assistants and their surrounding platforms may retain conversation content, forward it to tools, or expose it to operators, making plaintext credentials easy to leak. The danger is heightened here because the skill is specifically designed to authenticate against a financial data service using a real account password.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The user-facing documentation is written entirely in Chinese, including setup and usage directions, with no indication that other languages are supported or that Chinese is required for a region-specific purpose. This can violate a language/locale policy when a skill imposes a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The natural-language description forces a single language presentation and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. The policy specifically calls for flagging language or locale constraints when they are imposed without user opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
该 Markdown 文档从标题到正文均仅以中文呈现（如“API 参考”“本文档与 ... 一致”），没有说明这是面向特定中文用户群，也没有提供英文或语言切换选项。根据规则，强制单一语言且无用户选择可能构成自然语言层面的语言/locale 政策违规。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The natural-language docstring is written entirely in Chinese and presents the skill's usage and behavior only in that language. Under the policy criteria, forcing a specific language without user opt-in or a documented locale-specific justification is a language policy violation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The manifest describes an LLM tool wrapper for financial data queries, but this file is specifically designed so an agent can invoke it through
exec. While the script itself does not spawn subprocesses, exposing the skill through a command-line entrypoint for exec use introduces an execution-oriented capability that is not stated in the manifest's functional description of data-query methods.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code initializes credentials from environment variables, which is a sensitive operation under the audit criteria for code files. Although the module docstring explains usage, it does not warn that running the script will read credentials from the environment, and there is no confirmation prompt or user-facing disclosure at the point of use.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file states all changelog/versioning references in Chinese and links to zh-CN localized documentation, which indicates a language-specific constraint in the skill's natural-language materials. Because there is no opt-in, alternative language option, or explicit justification that the skill is region-specific, this may violate the language/locale policy criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The document states that login uses an '86手机号+ 密码' format, which imposes a specific locale/country-code requirement in natural language. Under the policy, locale constraints should either be optional, user-selectable, or clearly documented as a justified regional limitation; this line does not provide that justification.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file instructs users to set
PANDA_DATA_USERNAMEandPANDA_DATA_PASSWORDas API credentials, but it does not explicitly warn that the skill will use those secrets to authenticate to an external service. Under the markdown-specific missing-warning rule, credential use that affects privacy or external data access should be disclosed clearly.- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest describes the skill as supporting A-share行情、A股基本面、期货、指数等, which implies a China A-share-focused financial data wrapper. However, the API reference documents additional capabilities for港股 and美股 daily market data, extending the skill beyond the stated scope.
- Content
Static analysis
No suspicious patterns detected.