T09 · Insecure Skill Coding Practices
Warning
- Location
run.py:29- Finding
Path Traversal Enables Execution of an Unapproved Python Handler
- Content
View full analysis
- Remediation
View remediation
Security audit
Skills of A-share holder data released by ft.tech.
Security checks for vulnerabilities and agentic risk
Overview
The skill mainly performs disclosed A-share market data lookups, but its dispatcher can be steered toward unintended local Python handler execution if the subskill argument is misused.
Install only if you are comfortable with stock query parameters being sent to market.ft.tech and with running local Python handlers. Before broad use, the publisher should fix run.py to allow only the six documented subskill names and reject path traversal; no evidence of credential theft, persistence, or destructive behavior was found.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (23)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `run.py` 与本文件（`SKILL.md`）位于同一目录。执行时：
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill explicitly instructs reading local files, invoking a Python script, and relying on network access, but it does not declare any permission or tool scope boundaries. This creates an overbroad execution surface where an agent may use shell, file, and network capabilities without transparent restriction, increasing the risk of unintended command execution or data access if the skill or adjacent files are modified.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python print(f"错误：未找到 subskill '{subskill}'，路径不存在：{handler}", file=sys.stderr) sys.exit(1) result = subprocess.run( [sys.executable, handler] + sys.argv[2:], cwd=SKILL_ROOT, )
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ## 接口说明 | 项目 | 说明 | |----------|----------------------------------------------------------------------------------------------------------------------------| | 接口名称 | 查询所有期股权质押总揽数据 | | 外部接口 | `/data/api/v1/market/data/pledge/pledge-summary` |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 项目 | 说明 | |----------|----------------------------------------------------------------------------------------------------------------------------| | 接口名称 | 查询所有期股权质押总揽数据 | | 外部接口 | `/data/api/v1/market/data/pledge/pledge-summary` | | 请求方式 | GET | | 适用场景 | 获取 A 股市场所有报告期的股权质押总揽数据，包括质押公司数量、质押笔数、质押总股数、质押总市值、沪深300指数等信息，支持沪深京股票 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md |----------|----------------------------------------------------------------------------------------------------------------------------| | 接口名称 | 查询所有期股权质押总揽数据 | | 外部接口 | `/data/api/v1/market/data/pledge/pledge-summary` | | 请求方式 | GET | | 适用场景 | 获取 A 股市场所有报告期的股权质押总揽数据，包括质押公司数量、质押笔数、质押总股数、质押总市值、沪深300指数等信息，支持沪深京股票 | ## 请求参数
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring is user-facing natural language and fixes the skill's description to Chinese only. The policy requires avoiding forced language or locale without user opt-in or clear documented justification, and no such choice or justification appears in this file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The argparse description and argument help strings are natural-language UI text presented only in Chinese. This forces a specific language for users without presenting a language option or documenting a justified locale constraint in the file.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ## 请求参数 | 参数名 | 类型 | 是否必填 | 描述 | 取值示例 | 备注 | |------------|--------|----------|--------------|-----------|--------------------------------------------------------------------------------------------| | stock_code | string | 是 | 单个股票代码 | 603323.SH | 支持沪深京股票，A 股需为 6 位数字+后缀（SH=上交所，SZ=深交所，BJ=北交所），单次仅支持一个代码 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ## 请求参数 | 参数名 | 类型 | 是否必填 | 描述 | 取值示例 | 备注 | |------------|--------|----------|--------------|-----------|--------------------------------------------------------------------------------------------| | stock_code | string | 是 | 单个股票代码 | 603323.SH | 支持沪深京股票，A 股需为 6 位数字+后缀（SH=上交所，SZ=深交所，BJ=北交所），单次仅支持一个代码 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ## 请求参数 | 参数名 | 类型 | 是否必填 | 描述 | 取值示例 | 备注 | |------------|--------|----------|--------------|-----------|--------------------------------------------------------------------------------------------| | stock_code | string | 是 | 单个股票代码 | 603323.SH | 支持沪深京股票，A 股需为 6 位数字+后缀（SH=上交所，SZ=深交所，BJ=北交所），单次仅支持一个代码 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ## 请求参数 | 参数名 | 类型 | 是否必填 | 描述 | 取值示例 | 备注 | |------------|--------|----------|-----------------|-----------|------------------------------------------------------------------------------------------| | stock_code | string | 是 | 单个股票代码 | 603323.SH | 支持沪深京股票，A股需为6位数字+后缀（SH=上交所，SZ=深交所，BJ=北交所），单次仅支持一个代码 | | page | int | 否 | 页码，从 1 开始 | 1 | 默认值为 1，必须大于等于 1 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ## 请求参数 | 参数名 | 类型 | 是否必填 | 描述 | 取值示例 | 备注 | |------------|--------|----------|-----------------|-----------|------------------------------------------------------------------------------------------| | stock_code | string | 是 | 单个股票代码 | 603323.SH | 支持沪深京股票，A股需为6位数字+后缀（SH=上交所，SZ=深交所，BJ=北交所），单次仅支持一个代码 | | page | int | 否 | 页码，从 1 开始 | 1 | 默认值为 1，必须大于等于 1 |
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The module docstring and argument descriptions are entirely in Chinese, which imposes a specific language on users. Under the policy, locale or language constraints should either be optional for the user or clearly documented as a justified regional limitation; this file provides neither.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill directs the agent to execute run.py and perform HTTP GET requests to an external service, but it does not disclose to the user that their query parameters may be transmitted off-platform. While the data here appears to be stock-related rather than highly sensitive, the lack of user-facing notice weakens consent and can expose prompts or identifiers through external requests.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and user-facing usage/error messages are written only in Chinese, which imposes a specific language on users without any opt-in or alternative locale. The policy explicitly calls out language or locale constraints as violations when no choice is offered.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The file’s natural-language instructions and examples are entirely presented in Chinese, which can amount to a language/locale restriction for users if no opt-in or alternative is provided. The policy allows justified region-specific constraints or explicit language choice, but neither is stated here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The file’s only user-facing description is written in Chinese and presents the skill as operating in that language, with no indication that other languages are supported or that the user can opt in to a locale. Under the policy, language-specific behavior should either offer choice or be clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The markdown content forces a single language locale throughout the skill documentation, and there is no note that the language is region-specific or optional. Per the policy, language constraints should either offer user choice or be clearly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents all user-facing instructions and field descriptions only in Chinese. Under the policy, forcing a specific language without offering the user a language or locale choice is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The docstring and command-line help text are written only in Chinese, which may force a specific language experience for users without any opt-in or alternative. The policy calls for flagging language or locale constraints when the skill does not offer a language choice or clearly justify the restriction.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This code performs an HTTP request to a remote domain using the user-supplied stock code, but there is no confirmation prompt or explicit disclosure that input will be transmitted off-host. Because this is a code file, external data transmission should have some visible user disclosure unless it is clearly communicated elsewhere.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file presents all user-facing instructions and examples exclusively in Chinese, which can impose a language constraint without explicit user opt-in. The document does not state that the skill is intended only for Chinese-speaking users or a China-specific audience despite being user-facing documentation.
- Content
Static analysis
No suspicious patterns detected.