T01 · Skill Instruction Hijacking
Error
- Location
references/output-rules.md:1- Finding
Mandatory Promotional Content Hijacks Agent Output
- Content
View full analysis
- Remediation
View remediation
Security audit
A股每日新闻
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent A-share sentiment-reporting purpose, but it automatically opens locally generated HTML built from weakly sanitized external/user data and forces promotional subscription content into reports.
Install only if you are comfortable giving this skill a Redfox API key, sending A-share queries to redfox.hk, and receiving locally written reports. Review generated HTML paths before opening them, avoid untrusted keywords or JSON/report inputs, and treat the built-in subscription links as promotional rather than part of the requested analysis.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/stock_feed.py:557- Finding
Stored HTML and JavaScript Injection in Generated Reports
- Content
View full analysis
str: """Inline Markdown conversion: bold text and links""" import re text = text.replace("&", "&").replace("<", "<").replace(">", ">") text = re.sub(r'\[([^\]]+)\]\(([^)]+)\)', r'\1', text) text = re.sub(r'\*\*(.+?)\*\*', r'\1', text) return text ``` API or JSON-provided item and author URLs are inserted into HTML attributes without attribute escaping or validation: ```python item_url = item.get("url", "") url_attr = 'href="' + item_url + '"' if item_url else 'href="#"' author_link = item.get("author_link", "") author_html = ( '' + author_escaped + '' ) if author_link else ( '' + author_escaped + '' ) ``` The user-controlled keyword is inserted directly into both the document title and body: ```python A-share Daily News · {keyword} ``` ```python{keyword}``` The source comments and user-facing strings were translated where needed, but the executable expressions are unchanged. ### Technical Analysis The report generator constructs HTML through string concatenation and f-string interpolation. Dynamic values are not consistently encoded according to their destination context. The following injection surfaces are present: - `keyword` is inserted directly into HTML text contexts without HTML escaping. - `item_url` and `author_link` are inserted into quoted `href` at ...[truncated 3486 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README instructs users to 'simply describe what you need in natural language,' which is overly broad for a market-news skill and does not clearly constrain activation to stock-sentiment tasks. In agent environments, vague invocation guidance can cause the skill to trigger on unrelated financial or generic requests, leading to unintended tool use, unnecessary external data access, and confusing or unsafe behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example trigger phrases are generic enough to overlap with many ordinary finance queries, such as 'Show me the latest data' or broad stock-comparison requests. This increases the chance of accidental invocation outside the intended scope, especially in multi-tool agents where generic phrasing may route requests to this skill when another tool or no tool would be more appropriate.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The entire README, including invocation examples and usage guidance, is presented only in Chinese, and it does not state that the skill is region- or language-specific or offer an alternative language option. This can constitute a language/locale policy issue because it implicitly requires a specific language without user opt-in or justification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger guidance is broad enough that ordinary requests like '看看最新数据' or generic market questions could invoke the skill without the user clearly intending to access external financial-content aggregation. In a financial-analysis context, accidental activation can cause unexpected data retrieval, opinionated market summaries, and downstream actions based on misunderstood scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README states the tool will '自动生成并打开可视化 HTML 报告' but the skill description and earlier user-facing summary do not clearly warn that it will create and open a local HTML file automatically. Auto-opening generated HTML is security-relevant because reports may contain active content, external links, tracking resources, or misleading UI, and users may not expect a browser-launch side effect.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest description lists broad triggers such as “A股”, “大盘分析”, “选股”, and “股票讨论”, which are common phrases in normal stock-market conversations rather than narrowly scoped invocation commands. The activation condition also says to use the skill whenever a user wants to study A-share sentiment or market discussion, but it does not define clear exclusions or negative examples, increasing the risk of unintended invocation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill description, triggers, and operational instructions are entirely in Chinese and implicitly assume Chinese-language interaction, but the file does not state that this locale restriction is intentional or optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy issue unless the region/language constraint is clearly documented and justified.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to automatically run a local OS command to open a generated HTML file without explicit user confirmation. Auto-launching local content expands the skill from research/report generation into local execution side effects, and if the generated HTML contains unsafe active content or misleading links, it could trigger unwanted browser behavior or expose local context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill directs automatic HTML generation, local file writes, and automatic opening of the resulting file without warning the user about those side effects. This weakens informed consent and can surprise users with filesystem changes and application launches, which is risky in an agent context where users may expect read-only research behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document is written as mandatory output rules and templates entirely in Chinese, including fixed Chinese headings and phrasing such as the required title and section labels. This effectively forces a specific language/locale in generated output, and the file does not provide an opt-in, user choice, or a documented region-specific justification for the restriction.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The template injects promotional links to external subscription skills that are not necessary to fulfill the stated purpose of providing A-share news and sentiment analysis. This creates a hidden cross-promotion channel that can steer users into unrelated workflows, expanding trust and data-sharing surfaces without clear user intent or justification.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The comparison-query template repeats the same unrelated promotional content, meaning even analytical comparison requests are forced to include external skill advertisements. This is dangerous because it blends analysis with unsolicited redirection, which can manipulate user behavior and normalize hidden upsell paths inside trusted outputs.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest says the skill searches Xiaohongshu, Douyin, and WeChat public accounts, implying direct platform searches. In code, all data comes from one external endpoint at redfox.hk with platform-specific results parsed from its response, which is materially different behavior and trust model from directly querying the named platforms.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes a skill for searching and comparing A-share public-opinion/news across platforms, but this code also inspects local environment variables and a user config file to obtain credentials. While credential handling may support the network API call, reading from arbitrary local secret sources is an extra capability not stated in the skill description.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest claims cross-platform comparison and stock-market sentiment analysis, suitable for tasks like market review and stock-selection research. The implemented search path gathers posts, normalizes them, filters by keyword, and returns counts, but it does not compute sentiment, comparisons, trends, or analysis outputs beyond basic formatting.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code sets the document language to "zh-CN" in the generated HTML, and the surrounding UI text is also fixed in Chinese. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless the constraint is explicitly justified.
- Content
Static analysis
No suspicious patterns detected.