T09 · Insecure Skill Coding Practices
Warning
- Location
skill.yaml:46- Finding
Account Credentials Are Unnecessarily Declared as Invocation Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
tqsdk-test
Security checks for vulnerabilities and agentic risk
Overview
The skill’s market-data purpose is legitimate, but its documentation and manifest can lead users to submit account passwords in ordinary skill calls even though the code uses environment variables instead.
Install only if you configure TQ_USERNAME and TQ_PASSWORD through a protected secret or environment-variable mechanism. Do not put the Tianqin username or password in prompts, chat messages, README-style JSON examples, or normal skill request parameters. Review dependency pinning before use in a sensitive environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unbounded Dependency Versions Create Supply-Chain Exposure
- Content
View full analysis
=3.0.0 pandas>=1.3.0 ``` ### Technical Analysis Both dependencies use open-ended lower-bound constraints. A fresh installation may therefore resolve to any later release accepted by the package resolver. The project supplies no lock file, exact version pins, or cryptographic hashes to ensure that installations use versions that were reviewed during the audit. There is no evidence in the reviewed project that the currently available `tqsdk` or `pandas` packages are malicious. The vulnerability is the lack of reproducible and integrity-controlled dependency resolution. If a future release is compromised, malicious, or vulnerable, automatic installation can introduce that code without any change to this repository. Python packages can execute code during installation and are imported into the skill process at runtime. Consequently, a compromised dependency can run with the permissions available to the skill installation or execution environment. ### Attack Path 1. The skill is installed or rebuilt after a new dependency release becomes available. 2. The package resolver interprets `>=3.0.0` and `>=1.3.0` and selects a newer, unreviewed release. 3. A compromised upstream account, malicious release, or vulnerable transitive dependency introduces attacker-controlled behavior. 4. The package executes code during installation or when imported by the skill. 5. That code operates with the filesystem, network, environment-variable, and process permissions of the installer or skill runtime. This attack path depends on upstream compromise or publication of an unsafe release; no such compromise was established during this audit. ### Impact Assessment A malicious resolved dependency could potentially execute arbitrary Python code in the skill environment, read environment varia ...[truncated 254 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README instructs users to provide a username and password for a third-party market-data service, but it does not clearly state that these credentials will be transmitted externally during skill execution. This creates a real secret-handling and informed-consent risk: users may provide credentials without understanding where they go, how they are used, or whether the skill stores, logs, or forwards them.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill requires sensitive credentials via environment variables (
TQ_USERNAMEandTQ_PASSWORD) but does not declare any tool scope or permission boundary in the manifest. This creates an avoidable trust gap: operators and review systems cannot clearly see that the skill depends on secret access, increasing the risk of overbroad deployment or unnoticed secret exposure through future code changes.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language content of the manifest and README-style instructions is presented only in Chinese, including parameter descriptions, usage notes, and troubleshooting guidance. This effectively forces a specific language for users without any opt-in or explicit statement that the skill is intended only for Chinese-speaking or region-specific users.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest describes a skill for retrieving real-time and historical futures/options market data. While network access to the TqSdk service is expected for that purpose, directly reading TQ_USERNAME and TQ_PASSWORD from environment variables introduces credential-access capability that is not stated in the skill purpose and is not inherent from the manifest text alone.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest explicitly requires a username and password for a third-party trading data account, but it does not include any user-facing notice about sensitive credential handling, storage, transmission, or logging. In a skill ecosystem, collecting raw credentials without clear safeguards increases the risk of accidental exposure through logs, debugging output, or insecure secret management.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code initiates an authenticated connection to an external service via TqApi/TqAuth using the provided username and password. While the class docstrings describe functionality, there is no visible confirmation, logging, or explicit warning that credentials will be used to establish a remote connection and transmit market-data requests.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
A language or locale policy issue exists when a skill forces a specific language without user opt-in. This README presents all operational instructions in Chinese and does not mention any user language choice or justified locale restriction.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The dependency tqsdk is specified with a lower-bound only (>=3.0.0), which makes builds non-reproducible and allows future releases to be installed without review. That increases supply-chain risk because a compromised, malicious, or breaking upstream release could be pulled in automatically.
- Content
text tqsdk>=3.0.0 pandas>=1.3.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The pandas dependency is also unpinned, so installations may resolve to different versions over time. This weakens reproducibility and can expose consumers to newly introduced vulnerable or incompatible upstream releases.
- Content
text tqsdk>=3.0.0 pandas>=1.3.0
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language content in the manifest is entirely Chinese, which can force a specific language on users without opt-in or an alternative. The policy calls for flagging language or locale constraints when the skill does not explicitly offer a choice or justify the restriction.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
Multiple docstrings are written only in Chinese, which can impose a language-specific experience without user opt-in. The file does not indicate that the skill is region-specific or provide an alternative language option.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The class is presented as a straightforward wrapper for the 天勤量化 API, but in aexit it uses
await self._api.close(), while TqApi.close() is commonly a synchronous cleanup method. This is not a manifest-level scope issue, but it does indicate the async cleanup intent in the code diverges from the underlying operation and may fail at runtime rather than performing the documented resource cleanup.- Content
Static analysis
No suspicious patterns detected.