T09 · Insecure Skill Coding Practices
Error
- Location
run.py:25- Finding
Arbitrary Local Python Execution Through Sub-Skill Path Traversal
- Content
View full analysis
- Remediation
View remediation
Security audit
Skills of A-share kline data released by ft.tech.
Security checks for vulnerabilities and agentic risk
Overview
This stock-data skill mostly does what it says, but its local Python router can be tricked into running an unintended handler path if invoked with an unsafe sub-skill name.
Review before installing. The market-data behavior is disclosed and limited, but the router should be patched to allow only the two bundled sub-skill names before it is used in environments where prompts or users could influence command arguments. Do not invoke it with arbitrary sub-skill names or paths.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `run.py` 与本文件（`SKILL.md`）位于同一目录。执行时：
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill instructs the agent to derive a local filesystem path, read neighboring files, execute a Python script, and call external network endpoints, but it declares no explicit tool scope or permission boundaries. This creates an over-privileged and opaque execution model where an agent may use shell, file read, and network capabilities without user-visible restrictions, increasing the chance of unintended command execution or data access.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python print(f"错误：未找到 subskill '{subskill}'，路径不存在：{handler}", file=sys.stderr) sys.exit(1) result = subprocess.run( [sys.executable, handler] + sys.argv[2:], cwd=SKILL_ROOT, )
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ## 接口说明 | 项目 | 说明 | |----------|-------------------------------------------------------------------------------------------------------------------------------------------| | 接口名称 | 查询单只股票 OHLC K 线 | | 外部接口 | `/api/v2/stocks/:stock/ohlcs` |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 项目 | 说明 | |----------|-------------------------------------------------------------------------------------------------------------------------------------------| | 接口名称 | 查询单只股票 OHLC K 线 | | 外部接口 | `/api/v2/stocks/:stock/ohlcs` | | 请求方式 | GET | | 适用场景 | 获取 A 股指定股票在指定周期、时间范围内的 K 线（开高低收、成交量、成交额等），支持日/周/月/年线，支持截止时间与条数限制；响应中附带 MA5/MA10/MA20 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 项目 | 说明 | |----------|-------------------------------------------------------------------------------------------------------------------------------------------| | 接口名称 | 查询单只股票 OHLC K 线 | | 外部接口 | `/api/v2/stocks/:stock/ohlcs` | | 请求方式 | GET | | 适用场景 | 获取 A 股指定股票在指定周期、时间范围内的 K 线（开高低收、成交量、成交额等），支持日/周/月/年线，支持截止时间与条数限制；响应中附带 MA5/MA10/MA20 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md |----------|-------------------------------------------------------------------------------------------------------------------------------------------| | 接口名称 | 查询单只股票 OHLC K 线 | | 外部接口 | `/api/v2/stocks/:stock/ohlcs` | | 请求方式 | GET | | 适用场景 | 获取 A 股指定股票在指定周期、时间范围内的 K 线（开高低收、成交量、成交额等），支持日/周/月/年线，支持截止时间与条数限制；响应中附带 MA5/MA10/MA20 | ## 请求参数
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md 说明：`stock` 为路径参数（必填），`span` 为必填项，`limit` 和 `until_ts_ms` 为可选项。 | 参数名 | 类型 | 是否必填 | 描述 | 取值示例 | 备注 | |-------------|--------|----------|--------------------------------------------|-----------------------------------|--------------------------------------------------------------------------------------| | stock | string | 是 | 股票标的键（路径参数，带市场后缀） | 688295.XSHG、000001.SZ、920036.BJ | 沪 .XSHG、深 .SZ、北交所 .BJ | | span | string | 是 | K 线周期 | DAY1 | 可选值：DAY1（日线）、WEEK1（周线）、MONTH1（月线）、YEAR1（年线） |
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This file contains user-facing natural-language descriptions only in Chinese, starting with the module docstring and repeated in CLI help text. The policy requires avoiding forced language or locale constraints unless the user is given a choice or the restriction is clearly justified as region-specific.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ## 接口说明 | 项目 | 说明 | |----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 接口名称 | 查询单只股票分时价格（一分钟级别） | | 外部接口 | /api/v2/stocks/:stock/prices |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 项目 | 说明 | |----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 接口名称 | 查询单只股票分时价格（一分钟级别） | | 外部接口 | /api/v2/stocks/:stock/prices | | 请求方式 | GET | | 适用场景 | 获取 A 股指定股票在指定时间范围内的分时数据（一分钟一根），用于分时图、当日/多日走势；每条含该分钟的价格、成交量、成交额、均价、时间戳；支持从今天起、从五日前起、从 N 个交易日前起或从指定毫秒时间戳起；响应含昨收与当前交易日 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | 项目 | 说明 | |----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 接口名称 | 查询单只股票分时价格（一分钟级别） | | 外部接口 | /api/v2/stocks/:stock/prices | | 请求方式 | GET | | 适用场景 | 获取 A 股指定股票在指定时间范围内的分时数据（一分钟一根），用于分时图、当日/多日走势；每条含该分钟的价格、成交量、成交额、均价、时间戳；支持从今天起、从五日前起、从 N 个交易日前起或从指定毫秒时间戳起；响应含昨收与当前交易日 |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md |----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 接口名称 | 查询单只股票分时价格（一分钟级别） | | 外部接口 | /api/v2/stocks/:stock/prices | | 请求方式 | GET | | 适用场景 | 获取 A 股指定股票在指定时间范围内的分时数据（一分钟一根），用于分时图、当日/多日走势；每条含该分钟的价格、成交量、成交额、均价、时间戳；支持从今天起、从五日前起、从 N 个交易日前起或从指定毫秒时间戳起；响应含昨收与当前交易日 | ## 请求参数
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring and user-facing usage/error text are written entirely in Chinese, which imposes a specific language on users without offering a choice or opt-in. Under the policy, forcing a language or locale without user selection is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file presents all user-facing instructions and examples only in Chinese. Under the policy for natural-language violations, forcing a specific language without user opt-in or documented justification is reportable.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The entire SKILL.md uses Chinese-only instructions and examples, which can force a specific language on users without opt-in. Under the policy, language constraints should either offer user choice or be clearly justified as region-specific.
- Content
Static analysis
No suspicious patterns detected.