Security audit

Skills of A-share market data released by ft.tech.

Security checks for vulnerabilities and agentic risk

Overview

This skill is a broad read-only financial market data toolkit with some documentation drift, but I found no hidden persistence, credential use, destructive behavior, or purpose-mismatched execution.

Install only if you are comfortable with a broad financial-data skill making HTTPS requests to the FT market data services and, when you ask it to download files, writing PDFs, XML, or spreadsheets into the current working directory. Treat its results as data-provider output, and be aware that some documented announcement/report routes appear stale and may not work.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (180)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior is much broader and internally inconsistent with what is actually evidenced in the file, including references to undeclared or unshown capabilities. This kind of description-behavior mismatch is dangerous because reviewers and orchestration layers may trust the manifest while the skill routes to additional behaviors, weakening governance and making abuse or accidental overreach harder to detect.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.
md
`run.py` 与本文件（`SKILL.md`）位于同一目录。执行时：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 374)May include surrounding context.
md
`run.py` 与本文件（`SKILL.md`）位于同一目录。执行时：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 448)May include surrounding context.
md
`run.py` 与本文件（`SKILL.md`）位于同一目录。执行时：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 541)May include surrounding context.
md
`run.py` 与本文件（`SKILL.md`）位于同一目录。执行时：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 627)May include surrounding context.
md
`run.py` 与本文件（`SKILL.md`）位于同一目录。执行时：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 688)May include surrounding context.
md
`run.py` 与本文件（`SKILL.md`）位于同一目录。执行时：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 803)May include surrounding context.
md
`run.py` 与本文件（`SKILL.md`）位于同一目录。执行时：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 870)May include surrounding context.
md
`run.py` 与本文件（`SKILL.md`）位于同一目录。执行时：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 940)May include surrounding context.
md
`run.py` 与本文件（`SKILL.md`）位于同一目录。执行时：

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises shell, file-read, and network-driven behavior but declares no explicit tool scope or permission boundaries. In an agent environment, this creates an overly broad execution surface where the router could invoke local scripts and perform external requests without manifest-level constraints, increasing the risk of unintended command execution or data access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The top-level description is entirely in Chinese and defines when the skill should be used, but it does not offer any language or locale selection. This can violate a language/locale policy when users or downstream agents are expected to operate in multiple languages unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The user-utterance mapping table is entirely Chinese and is used to determine invocation routing, yet there is no explicit statement that the skill is limited to Chinese-language queries or that users may choose another language. Because these routing phrases govern activation behavior, the lack of language choice is a policy concern rather than just documentation style.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file starts as a market-data skill but later expands into multiple other domains such as announcements, reports, shareholder data, financial statements, ETF/index/K-line modules, and macro data. This scope sprawl is risky because a single entrypoint can be used to reach capabilities beyond what a caller or reviewer expects, undermining least privilege and increasing the blast radius of prompt-routing mistakes.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The same file repeatedly claims to be the unified entrypoint for several differently named skills, creating ambiguity about identity, ownership, and callable scope. That ambiguity is dangerous in security review and runtime policy enforcement because a platform may approve one skill name while effectively exposing several others through the same artifact.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The module docstring, usage output, and error messages are entirely in Chinese, which imposes a language choice on users. Under the stated policy, a fixed language without user opt-in or a documented region-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest description says to use the skill when a user asks about '某概念板块走势' or '板块历史行情', which are broad natural-language topics without clear boundaries or exclusion conditions. In a routing context, this can cause unintended invocation for general market-discussion requests rather than only explicit requests for THS board historical K-line data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file-level docstring is written as a directive to query A-share block trades in Chinese, with no indication that the skill supports other languages or that the locale restriction is optional. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: L003 使用“用户问可转债基础信息、转债详情、某只可转债、转股价、转股价值、到期日、发行规模时使用”来描述触发条件，其中“某只可转债”“转债详情”等表述较宽泛，未明确边界或排除条件。该描述缺少精确触发短语、上下文限制或负例，容易在相邻但不同意图的债券查询场景中被误调用。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description and the entire skill documentation are written only in Chinese, including the user-trigger examples, with no indication that users may interact in other languages or that this skill is intentionally limited to a Chinese-only context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description and document title are entirely written in Chinese and describe usage only in Chinese, which indicates a language-specific interaction model. Under the policy, language constraints should either offer user opt-in/choice or be clearly documented as a justified region-specific constraint; this file does not explicitly do so.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language strings in the module docstring, argument parser description, and argument help are all Chinese-only, with no indication that the skill is region-specific or that users may choose another language. This creates a language/locale policy concern because the skill appears to force a specific language without opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger description uses several broad and overlapping keywords such as '信贷', '中国信贷', '贷款增量', and '社会融资' without clear boundaries for when this skill should activate instead of other macroeconomic or financing-related skills. In an agent setting, this can cause over-triggering and tool misselection, leading the system to fetch or present the wrong financial dataset to users, which is especially risky in a market-data skill suite where nearby concepts are semantically similar.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The only natural-language description in the file is the Chinese-only docstring "中国海关进出口（月度）", which indicates a fixed language/locale with no evidence of user selection or opt-in. The policy explicitly calls for flagging language or locale constraints when the skill does not offer a language choice or clearly justify the restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The natural-language description and headings are primarily in Chinese and the invocation examples are centered on Chinese trigger phrases, while also handling English fiscal terms. There is no explicit statement that the skill is China-specific and intended to respond in Chinese only, nor any opt-in for language choice, which can violate a language/locale policy requiring user choice or documented justification.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: sub-skills/etf-detail/scripts/test_handler.py:21

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: sub-skills/etf-list-paginated/scripts/test_handler.py:21

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: sub-skills/etf-ohlcs/scripts/test_handler.py:22

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: sub-skills/etf-prices/scripts/test_handler.py:21

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: sub-skills/index-detail/scripts/test_handler.py:21

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: sub-skills/index-list-paginated/scripts/test_handler.py:21

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: sub-skills/index-ohlcs/scripts/test_handler.py:22

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: sub-skills/index-prices/scripts/test_handler.py:21

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: sub-skills/margin-trading-details/scripts/test_handler.py:20

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: sub-skills/stock-ohlcs/scripts/test_handler.py:22

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: sub-skills/stock-prices/scripts/test_handler.py:21

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: sub-skills/stock-quotes-list/scripts/test_handler.py:21