Security audit

公司深度分析助手

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent A-share/HK-share research assistant that discloses its data collection, scripts, temporary files, and report generation, though it has hardening issues users should understand.

Install only if you are comfortable with a Chinese-language stock-analysis skill that runs local Python scripts, makes public web/API requests for the company or stock code you provide, and creates report files. For stronger security, run it in an isolated environment, pin dependencies, avoid feeding proprietary watchlists or confidential research context, and treat the generated investment analysis as informational rather than advice.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/collect_data.py:790
Finding: Predictable Temporary File Permits Symlink Redirection and Data Tampering
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Third-Party Python Dependencies Are Not Reproducibly Pinned or Hash-Verified
Content: View full analysis
=2.28.0 pandas>=2.0.0 lxml>=4.9.0 html5lib>=1.1 ``` The documented installation command resolves these open-ended requirements from the configured Python package index: ```bash pip install -r requirements.txt ``` ### Technical Analysis Each dependency uses only a minimum version constraint. This allows pip to select any later release available at installation time. No lock file, package hashes, index restrictions, or reviewed transitive dependency set is provided. As a result: - Two installations at different times can resolve to different package versions. - A future compromised or unexpectedly incompatible release may be selected automatically. - Transitive dependencies can change without a corresponding project review. - Package artifacts are not authenticated against project-maintained hashes. - The installed environment cannot be reliably reproduced from the repository alone. The package names themselves appear legitimate; no evidence of typosquatting or an intentionally malicious dependency was found. The issue is supply-chain hardening rather than proof that the current packages are malicious. ### Attack Path 1. A direct or transitive dependency publishes a compromised release, or its distribution account is taken over. 2. The compromised version still satisfies the open-ended `>=` constraint. 3. A user follows the documented command `pip install -r requirements.txt`. 4. Pip resolves and downloads the compromised release from the configured index. 5. Malicious package installation behavior or imported package code executes with the privileges of the user running pip or the analysis scripts. 6. The package can access files, environme ...[truncated 788 chars]
Remediation: View remediation
pandas== lxml== html5lib== ``` 2. Generate a lock file that includes all transitive dependencies. 3. Record and enforce artifact hashes using a tool such as `pip-tools`: ```bash pip-compile --generate-hashes requirements.in pip install --require-hashes -r requirements.txt ``` 4. Use a trusted, explicitly configured package index and disable unintended extra indexes. 5. Install dependencies in an isolated virtual environment under a non-privileged account. 6. Add automated dependency vulnerability scanning and scheduled review of pinned versions. 7. Review release notes and provenance before updating locks. 8. Consider reducing dependencies where standard-library functionality is sufficient. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

Location: templates/briefing-card-template.html:385
Finding: Generated HTML Retrieves and Executes Remote JavaScript Without Integrity Verification
Content: View full analysis
Remediation: View remediation
" crossorigin="anonymous"> ``` 3. Verify the integrity value against the exact distributed artifact before release. 4. Add a restrictive Content Security Policy. If inline script is retained, use a nonce or hash rather than allowing unrestricted inline execution. 5. Restrict outbound connections with `connect-src` and avoid permissive wildcard sources. 6. Host generated reports on an isolated origin without access to application cookies, credentials, or sensitive same-origin APIs. 7. For fully self-contained reports, embed a reviewed script artifact during generation and record its cryptographic digest in release metadata. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (35)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The documented behavior claims a bounded 6-step analysis workflow, but the skill also instructs the agent to read and write temporary files, execute scripts, and rely on undeclared external resources. This mismatch is dangerous because reviewers and users may approve the skill based on a much safer description than what it can actually do in practice.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented behavior claims a bounded 6-step analysis workflow, but the skill also instructs the agent to read and write temporary files, execute scripts, and rely on undeclared external resources. This mismatch is dangerous because reviewers and users may approve the skill based on a much safer description than what it can actually do in practice.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: The skill instructs execution of rm -f /tmp/{股票代码}_data.json, where the file path is derived from variable input. If input normalization is incomplete or bypassed, this creates a command-injection or arbitrary file deletion risk; even with intended stock-code formats, using shell deletion on interpolated paths is an unsafe pattern.
Content: Scanner excerpt · SKILL.md (reported line 570)May include surrounding context.
分析完成后清理临时数据：

bash
rm -f /tmp/{股票代码}_data.json

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file records a trigger set including generic phrases such as "财务情况", "财务分析", "公司画像", and "行业研究", which are broad everyday analytical requests rather than narrowly scoped invocation commands. The description does not include exclusion conditions or negative examples, increasing the risk of unintended activation in normal conversation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documented trigger examples are broad, natural-language phrases like '公司分析', '深度分析', and '行业研究' that can easily overlap with ordinary conversation. In an agent environment, this can cause unintended invocation of a workflow that performs external data collection, web search, and file generation, increasing the risk of surprise side effects and data egress.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The routing table uses generic keywords like '财务' and falls back to '默认全跑' when the request is unspecified. This makes the activation boundary ambiguous and can escalate a casual mention into the most expansive behavior, including multi-step analysis and external calls, without clear user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README mentions temporary file writes but does not clearly foreground that the skill sends requests to multiple third-party financial sources and uses WebSearch for qualitative supplementation. Users may therefore underestimate privacy, compliance, and network-exposure implications, especially if they provide sensitive watchlists, proprietary research context, or internal company names in prompts.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill requires broad capabilities—shell, network, file read/write, and environment access—but does not declare any tool scope or allowed-tools boundary. That omission weakens least-privilege controls and makes it easier for the skill to invoke powerful operations without clear review or user awareness.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrases include very broad terms such as '公司分析', '行业研究', and '财务分析', which can match ordinary conversation and activate the skill unintentionally. Because the skill can perform file, shell, and network operations, accidental activation materially raises the chance of unintended data collection or command execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill creates report files and temporary data under /tmp, then later deletes temporary files, but this side effect is not clearly surfaced to users in the description. Hidden file creation/deletion reduces user awareness and can surprise downstream systems or erase evidence needed for troubleshooting and audit.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill directs the agent to probe the environment and execute shell and Python commands as part of ordinary processing. In a skill that is nominally for company analysis, this increases the attack surface because user-controlled inputs can flow into command execution paths or encourage broader system interaction than users expect.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The fallback path instructs the agent to use generic WebFetch/curl against multiple third-party endpoints, effectively granting broad outbound network behavior. This is risky because it bypasses tighter, reviewed integrations and can expose the system to data exfiltration patterns, SSRF-like misuse, or unvetted remote content handling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The markdown explicitly states '中文（默认）', which imposes a language default in natural-language instructions. Under the policy, forcing a specific language or locale without offering user choice or opt-in is a violation unless clearly justified as region-specific, which is not stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The title and instructions are entirely in Chinese and state this file is loaded as part of the reporting workflow, but there is no indication that language is optional or limited to a China-specific compliance context. This can amount to a locale policy violation because the skill appears to force a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: 该文件标题及全文指令均以中文固定表述，未见任何允许用户选择语言或声明仅适用于中文工作流的说明。根据规则，未获用户选择或无明确、合理限定的语言/地区约束，属于自然语言层面的语言政策违规。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file title and all operational instructions are written in Chinese, indicating the skill is designed to run in a fixed language context. There is no visible opt-in, language selection, or justification that this skill must be Chinese-only for a region-specific use case, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file’s natural-language interface, usage text, status messages, and output descriptions are entirely in Chinese, which effectively imposes a specific language on users. Under the policy, locale or language constraints should either offer user opt-in/choice or be explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/collect_data.py (reported line 537)May include surrounding context.
python
"pageNum": str(page), "pageNumber": str(page)} d = http_get("https://reportapi.eastmoney.com/report/list", params=params, headers={"Referer": "https://data.eastmoney.com/"}, timeout=30) rows = d.get("data") or [] if not rows: break

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This Python file contains user-facing natural-language content such as the module docstring and CLI usage/error messages entirely in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which is not indicated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This Python file contains user-facing natural-language documentation entirely in Chinese and presents the module interface and behavior in that language as the default, with no opt-in or alternative locale. Under the policy, forcing a specific language without user choice can be a locale-policy violation unless the regional constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The HTML root sets lang="zh-CN", and the visible UI text throughout the template is fixed in Chinese. This imposes a specific language/locale on all users without any opt-in mechanism or explanation that the template is intended only for a China-specific audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The template title and the entire document are written as a fixed Chinese output format, indicating the skill expects responses in Chinese by default. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless a justified region-specific constraint is documented, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown template is written entirely in Chinese and includes explicit Chinese-only formatting/content requirements such as '中文字体' and Chinese phrasing conventions, which imposes a specific language/locale on the generated report. Under the policy, a forced language is a natural-language policy violation unless the skill offers user opt-in or clearly documents a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The template instructs use of a direct CLI invocation (collect_data.py --finances ...) to gather comparable-company financial data, but this behavior is not declared in the manifest's described workflow. Undocumented execution paths expand the skill's capabilities beyond what reviewers and users expect, creating a hidden data-access surface and increasing the risk of unauthorized local command execution or misuse of internal tooling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 70% confidence
Finding: The natural-language content in this file is entirely Chinese and the listed trigger phrases are also Chinese, which suggests the skill may be constrained to a specific language. There is no visible indication in this file that users can choose another language or that the locale restriction is explicitly opt-in or justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.