Security audit

Skills of A-share fund data released by ft.tech.

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed fund-data lookup tool that runs bundled Python handlers and calls a fixed market.ft.tech API without credentials, persistence, or hidden behavior.

Install only if you are comfortable with the skill running its bundled Python scripts and sending fund codes, pagination values, and selected return periods to market.ft.tech. It appears to access public fund data only, but users who need strict governance may want an explicit permission manifest limiting execution to run.py and network access to that domain.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.
md
`run.py` 与本文件（`SKILL.md`）位于同一目录。执行时：

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to read local files, invoke a Python runner, and access a remote HTTPS API, but it does not declare any explicit tool/permission scope. This creates a governance gap: an orchestrator may expose broader shell, file, or network capabilities than intended, making misuse or overreach harder to constrain or audit.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The top-level description is broad enough to match many ordinary finance queries such as fund details, NAV, returns, or lists, without clear exclusions or tighter routing conditions. Overbroad triggers can cause the skill to activate in unintended contexts, leading to unnecessary tool use, external data access, or accidental overshadowing of safer or more appropriate skills.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The mapping table relies on phrases like '用户常说的词' and common-language categories, but it does not define boundaries, precedence, or disambiguation rules between overlapping intents. In practice, ambiguous routing can send a user request to the wrong sub-skill, triggering incorrect network calls or exposing broader data than needed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python file contains natural-language docstrings and CLI messages entirely in Chinese, including usage instructions and errors. Under the stated policy, forcing a specific language without offering a language/locale choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The CLI help and error messages printed at runtime are hard-coded in Chinese only. This enforces a specific language for end users without any documented opt-in or locale selection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description specifies usage only for Chinese phrases such as "支持的基金列表" and related variants. This creates a locale/language constraint in the skill's natural-language interface without any opt-in, alternative language support, or explanation that the skill is intentionally region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The description lists invocation examples only in Chinese terms such as '基金累计收益率' and related phrases, which implies a language-specific activation policy. The file does not state that the skill is intentionally limited to Chinese users or provide any opt-in or alternative language handling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The module docstring and CLI description/help text are written only in Chinese, which imposes a specific language on users without offering an alternative or opt-in. This matches the language/locale policy concern for natural-language content in code files.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.