Security audit

Skills of A-share news data released by ft.tech.

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed news-search wrapper that sends user search terms to market.ft.tech and returns recent news results.

Install this only if you are comfortable sending news-search text and time filters to market.ft.tech. Expect Chinese-language instructions/output and Beijing-time handling for date filters.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs the agent to invoke a local Python entrypoint and states that it may perform file reads, network access, and shell execution, but the manifest does not declare any explicit tool scope or permissions boundary. This creates an over-privileged integration surface where a host agent may grant broader capabilities than intended, making misuse or unintended execution harder to constrain or audit.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description and main instructions are written entirely in Chinese and describe the skill's usage in Chinese terms, but there is no indication that users may interact in other languages or that Chinese-only behavior is an intentional, justified regional limitation. This creates a natural-language locale policy concern because the skill appears to assume a fixed language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module docstring presents all usage instructions exclusively in Chinese, and the runtime messages are also Chinese-only. For a general dispatcher entrypoint, this imposes a specific language/locale without opt-in or explanation, which matches the policy category for language or locale violations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description is written as a directive for use in Chinese and does not indicate that users may choose another language. Under the policy, locale or language constraints should either be optional or clearly justified; no such opt-in or justification appears here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The docstring states that all input times are normalized to Beijing time (UTC+8), and the implementation enforces that locale-specific behavior. This is a natural-language locale policy concern because the skill does not offer the user a choice of timezone or clearly justify why Beijing time is mandatory.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.