financial-data-gateway

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:16 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent Chinese A-share financial-report workflow with disclosed network, file, and OpenAI API use, though users should note dependency and data-integrity cautions.

Install in an isolated environment, consider pinning dependencies, and avoid processing confidential PDFs unless sending page summaries to OpenAI is acceptable. Treat extracted financial data as needing validation, especially because the CNInfo discovery endpoints are documented as plaintext HTTP.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: cninfo-report-download.md:17

Finding

Unpinned requests Dependency Allows Unreviewed Supply-Chain Changes

Content

View full analysis

Vulnerability Details

File Location: cninfo-report-download.md, lines 17-18
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

install: |
  pip install requests

Technical Analysis

The installation command does not constrain requests to a reviewed version and does not verify package hashes. Consequently, installation resolves whichever compatible release the configured package index serves at installation time.

This makes the installed code different from the code assessed during the Skill review. Exploitation would require compromise of the upstream package, the configured package index, or the package-resolution channel. A malicious release or substituted distribution could execute code during installation or when the Skill imports the dependency.

Attack Path

1. An attacker compromises the upstream dependency distribution, package index, or dependency-resolution channel.
2. The attacker causes a malicious or modified requests release to be selected.
3. A user follows the documented pip install requests instruction.
4. The package manager downloads and installs the unreviewed release.
5. Malicious dependency code executes during installation or when imported by the Skill.

Impact Assessment

Malicious dependency code would run with the privileges of the account installing or invoking the Skill. It could access files, environment variables, network resources, and credentials available to that account. The package itself does not document privilege escalation, so the expected scope is limited to the invoking user's permissions and runtime environment.

Remediation

View remediation

Remediation Suggestions

1. Pin requests to a reviewed, exact version rather than resolving the latest available release.
2. Supply a hash-locked requirements file generated from reviewed artifacts.
3. Install with hash enforcement, for example:

   bash

   pip install --require-hashes -r requirements.txt
   

4. Use a trusted internal package mirror or an authenticated package index.
5. Run dependency vulnerability and provenance checks in CI.
6. Periodically update dependencies through a controlled review process rather than allowing automatic resolution at installation time.

T08 · Insecure Dependencies

Warning

• Location: financial-statement-extraction.md:21

Finding

Unpinned PDF and OpenAI Dependencies Allow Unreviewed Supply-Chain Changes

Content

View full analysis

Vulnerability Details

File Location: financial-statement-extraction.md, lines 21-22
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

yaml

install: |
  pip install pdfplumber openai

Technical Analysis

The installation command resolves mutable versions of pdfplumber, openai, and their transitive dependencies without version constraints or artifact hashes. A future installation can therefore retrieve dependency code that was not present during this audit.

This is particularly significant because the extraction component reads local PDF files, accesses the OPENAI_API_KEY environment variable, communicates over the network, and writes output files. If the dependency supply chain or configured package index were compromised, substituted package code would execute in this security-sensitive context.

Attack Path

1. An attacker compromises a dependency release, a transitive dependency, the configured package index, or the dependency-resolution channel.
2. A malicious distribution becomes the version selected by the unconstrained installation command.
3. A user runs pip install pdfplumber openai.
4. The malicious package is installed without hash verification.
5. Its code executes during installation or when imported for PDF processing or API access.
6. The malicious code accesses resources available to the Skill process, potentially including local PDFs and the OpenAI API credential.

Impact Assessment

Exploitation could permit arbitrary code execution with the privileges of the installing or invoking user. Accessible assets may include input financial documents, generated JSON files, environment variables such as OPENAI_API_KEY, and network connectivity available to the process. No mechanism for elevation beyond the invoking user's privileges is documented.

Remediation

View remediation

Remediation Suggestions

1. Pin direct and transitive dependencies to reviewed versions.
2. Maintain a lockfile or hash-locked requirements file containing hashes for every distribution.
3. Enforce package hashes during installation with --require-hashes.
4. Retrieve packages only from trusted and authenticated repositories.
5. Scan dependencies for known vulnerabilities and unexpected ownership or provenance changes.
6. Install and execute the Skill in an isolated, least-privileged environment.
7. Expose OPENAI_API_KEY only to the extraction process and use a restricted, revocable credential.

T09 · Insecure Skill Coding Practices

Warning

• Location: cninfo-report-download.md:179

Finding

CNInfo API Queries Use Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: cninfo-report-download.md, lines 179-196
Vulnerability Type: Unencrypted external API communication
Risk Level: Medium

Vulnerable Code

http

POST http://www.cninfo.com.cn/new/hisAnnouncement/query
Content-Type: application/x-www-form-urlencoded

http

POST http://www.cninfo.com.cn/new/information/topSearch/query

Technical Analysis

Both documented CNInfo API endpoints use plaintext HTTP. HTTP does not authenticate the server or protect request and response integrity. An attacker able to observe or modify the network path could intercept requests, alter company lookup results, modify organization identifiers, or substitute annual-report search metadata.

The subsequent download is documented as using HTTPS, but the path used for that download is derived from API metadata. Therefore, TLS on the final download alone does not establish that the selected report is the intended report. Strict hostname enforcement and content validation can limit substitution, but they do not correct manipulated search metadata.

Attack Path

1. The Skill sends a company lookup or annual-report search request over plaintext HTTP.
2. A network-positioned attacker intercepts the request or response.
3. The attacker changes the returned company metadata, organization identifier, announcement title, or report path.
4. The Skill accepts the modified response and selects an attacker-influenced or incorrect report.
5. The report is saved locally and passed to the financial-statement extraction stage.
6. Downstream analysis consumes incorrect financial data while treating it as the requested company's official report.

Impact Assessment

The primary impact is loss of data integrity and authenticity. An attacker could cause selection of an incorrect public report, corrupt the generated financial dataset, and influence downstream valuation, comparison, or reporting r ...[truncated 257 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace every CNInfo API URL with its HTTPS equivalent.
2. Keep TLS certificate and hostname verification enabled and reject invalid certificates.
3. Do not silently downgrade or redirect from HTTPS to HTTP.
4. Restrict redirects to an explicit allowlist of expected HTTPS hosts.
5. Validate API responses against a strict schema before using identifiers or paths.
6. Ensure report paths are relative, normalized, and resolved only beneath the expected https://static.cninfo.com.cn/ origin.
7. Reject responses containing unexpected schemes, hosts, content types, or malformed identifiers.
8. Verify downloaded files have a PDF content type and valid PDF signature, and correlate report metadata with the requested stock code, company, reporting year, and report type.
9. Where the publisher provides trusted checksums or signatures, verify them before downstream processing.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file consistently forces Chinese-language interaction and documentation, from the manifest description through the operational sections, with no indication that users can choose another language. Under the stated policy, a fixed language without user opt-in is a natural-language policy violation unless clearly justified as region-specific; this file does not explicitly document such a justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill documentation is written entirely in Chinese and the stated limitations explicitly say English financial reports are unsupported, but it does not clearly present this as a documented locale/language constraint or offer any user opt-in or choice. Under the language/locale policy, forcing a specific language without user choice or clear justified constraint can be a policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest description states the skill is for extracting data from Chinese A-share annual reports, and the rest of the document consistently limits support to Chinese reports. Because the file presents this as a fixed language/locale constraint rather than offering a user choice, it falls under the language/locale policy check.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The limitations section says the mapping table only covers Chinese A-share annual reports and does not support SEC 10-K/10-Q filings. This is a natural-language locale restriction presented as a fixed policy rather than a user-selectable option or clearly justified regional compliance requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file describes two operations that affect local user data and filesystem state: saving downloaded PDF reports to workspace/reports/ and writing structured extraction output to an output directory. While the inputs/outputs are documented, there is no explicit warning or disclosure about local file creation/overwrite behavior or storage impact, which is the kind of user-facing warning expected for markdown skill descriptions.

Content

No source excerpt is available for this finding.