Tecent Finance 1.0.0

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:31 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward finance-quote helper, but users should treat its install notes as incomplete and use a virtual environment with pinned dependencies.

Before installing, verify the missing tfin implementation from a trusted source, install dependencies in a dedicated virtual environment, pin reviewed package versions, and avoid running pip or creating the /usr/local/bin symlink with administrator privileges unless necessary.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:126

Finding

Unpinned Third-Party Dependencies Installed into the Active Python Environment

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 126-132
Vulnerability Type: Unpinned and integrity-unverified third-party dependencies
Risk Level: Medium

Vulnerable Code

markdown

## Requirements

- Python 3.7+
- requests
- rich

```bash
pip3 install requests rich

text

### Technical Analysis

The installation command retrieves `requests` and `rich` without exact version constraints, cryptographic hashes, or a lockfile. Consequently, the packages installed at any given time may differ from the versions originally intended or reviewed.

Python package installation can execute package build and installation logic with the privileges of the user running `pip3`. If a future dependency release or its distribution channel is compromised, following these instructions could execute attacker-controlled installation logic. Installing into the active Python environment also increases the chance of dependency conflicts and expands the impact beyond this Skill.

The package contains no implementation source or executable corresponding to the documented `tfin` command, so the audit could not verify how these dependencies would be used or determine a minimal trusted dependency set.

### Attack Path

1. A user follows the documented installation instructions and runs `pip3 install requests rich`.
2. `pip3` resolves mutable package versions from its configured package index.
3. A compromised release, package-index response, or affected transitive dependency is downloaded because no approved versions or hashes are enforced.
4. Package build or installation logic executes with the invoking user's privileges.
5. Attacker-controlled logic may access data and modify files available to that user. If the command is run with elevated privileges, the potential scope expands to system-level resources.

This path is conditional on compromise of a resolved package or package-distribution channel; the audited fi
...[truncated 620 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an explicitly reviewed version.
2. Use a hash-locked requirements file, for example with --require-hashes, or provide a reproducible lockfile generated by a trusted dependency-management tool.
3. Review and lock transitive dependencies, not only requests and rich.
4. Install dependencies inside a dedicated virtual environment rather than the global Python environment.
5. Avoid running package installation as root or with administrator privileges.
6. Configure an approved package index and use TLS certificate verification.
7. Add automated dependency vulnerability and integrity scanning to the release process.
8. Include the missing tfin implementation in the package so its behavior and actual dependency requirements can be audited.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.