Security audit

market-data

Security checks for vulnerabilities and agentic risk

Overview

This market-data skill includes a generic cross-skill learning script that writes persistent local usage notes and preferences, which is broader than its stated stock-data purpose.

Review this before installing if you do not want a skill to keep local cross-session notes. Avoid recording secrets, account details, proprietary strategy information, or sensitive project context in its learner commands, and consider removing or disabling scripts/learner.py unless you explicitly want that persistence.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior significantly exceeds and diverges from the declared market-data purpose by introducing a generic self-learning and persistent recording mechanism unrelated to quote retrieval. Description-behavior mismatch is dangerous because users and orchestrators may trust the skill for harmless financial data access while it also encourages local data retention and broader capability patterns that were not clearly declared or justified.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill advertises operational patterns that include persistent learning commands and a documented write target (learned_patterns.json), but it does not declare any tool scope or permissions boundaries. This creates an implicit file-write capability that an agent may invoke without clear user visibility or policy enforcement, increasing the risk of unintended local state changes or persistence.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The self-learning section instructs the agent to persist notes, failures, and insights to learned_patterns.json, which is unrelated to the stated market-data function. Unnecessary persistent memory increases the risk of collecting sensitive user/project information, creating hidden state across runs, and expanding the skill from read-oriented data retrieval into write-capable profiling or telemetry behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This module explicitly advertises itself as a generic cross-skill self-learning component for arbitrary WorkBuddy skills, which exceeds the declared purpose of a market-data skill. Scope expansion is dangerous because it introduces persistent behavioral tracking and adaptation capabilities that can be reused outside the stated domain, undermining least-privilege and making it harder for users to understand or constrain what the skill does.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code file contains user-facing natural-language documentation and CLI messages only in Chinese, which effectively forces a specific language/locale on users. The policy allows locale constraints only when they are explicitly justified or when users are given a choice, neither of which appears here.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code persistently stores operational history, error notes, and user preferences in learned_patterns.json, creating a local telemetry store unrelated to simple market/financial data retrieval. If notes or preference values contain sensitive data, this can leak user behavior, business context, or secrets across sessions; the risk is increased because the tool accepts arbitrary skill_dir input and writes to that location.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.