Portfolio Daily Tracker

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:33 AM UTC
• Version: 1.2.0

Overview

This portfolio tracker has a coherent purpose, but installation and runtime behavior give it broad mutable code and financial-data authority that users should review before installing.

Review before installing. Use this only in an isolated project or virtual environment, pin and verify the external engine repository before setup, avoid global pip installs, keep webhook and bot tokens scoped to private destinations, and require explicit confirmation before any holding deletion, cash/fund overwrite, or report push.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/setup.sh:19

Finding

Unpinned Remote Repository Retrieval and Dependency Execution

Content

View full analysis

Vulnerability Details

File Location: scripts/setup.sh:19, scripts/setup.sh:46
Vulnerability Type: Mutable remote payload retrieval and insecure dependency installation
Risk Level: High

Vulnerable Code:

bash

git clone https://github.com/Stepuuu/portfolio-daily-tracker.git "$TARGET"

bash

if command -v pip3 &>/dev/null; then
  pip3 install -r dashboard/requirements.txt 2>/dev/null || echo "  ⚠ pip install failed — install manually: pip3 install -r dashboard/requirements.txt"
else
  echo "  ⚠ pip3 not found — install manually: pip3 install -r dashboard/requirements.txt"
fi

Technical Analysis

The setup script clones the current default branch of an external Git repository without pinning a reviewed commit, verifying a signed tag, or checking a cryptographic digest. It then passes a requirements file from that mutable repository directly to pip3.

Consequently, the code and dependencies installed at setup time may differ from those present when this Skill was audited. A repository owner, compromised maintainer account, or supply-chain attacker could change the default branch or its requirements after publication. Python package installation may execute package build hooks, while the downloaded engine scripts are explicitly invoked during normal Skill operation.

This is a remote payload execution boundary rather than merely a network availability concern: the externally controlled repository determines both executable engine code and the dependency installation manifest.

Attack Path

1. An attacker compromises the remote repository, a maintainer account, or a dependency referenced by its requirements file.
2. The attacker modifies the default branch, adds a malicious dependency, or replaces an expected package version with a compromised release.
3. A user follows the documented setup process and runs scripts/setup.sh.
4. The script clones the mutable default ...[truncated 827 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the repository to a specific, reviewed commit hash rather than cloning the mutable default branch.
• Verify a cryptographically signed release tag and compare the checkout against an expected commit identifier.
• Prefer shipping the audited engine code with the Skill so that its effective implementation cannot change independently.
• Use a fully locked dependency manifest containing exact versions and cryptographic hashes, and install with pip --require-hashes.
• Review direct and transitive dependencies before updating the lock file.
• Install dependencies in a dedicated virtual environment or other isolated execution environment instead of the caller's global Python environment.
• Avoid suppressing pip error output, because doing so obscures security-relevant installation failures.
• Run setup and engine components with a minimally privileged account that does not expose unrelated secrets.

T09 · Insecure Skill Coding Practices

Error

• Location: tools/portfolio_tools.py:111

Finding

Arbitrary Module Execution Through Unvalidated Python Import Path

Content

View full analysis

Vulnerability Details

File Location: tools/portfolio_tools.py:111-119 and tools/portfolio_tools.py:157-163
Vulnerability Type: Python import-path injection
Risk Level: High

Vulnerable Code:

python

async def update_holdings(date: str, changes_text: str) -> Dict:
    """Update holdings based on natural language description."""
    import sys
    if scripts_dir:
        sys.path.insert(0, scripts_dir)
    
    from portfolio_daily_update import (
        clone_holdings, load_holdings, save_holdings,
        parse_and_apply_changes
    )

python

async def run_portfolio_pipeline(date: str, send_report: bool = True) -> Dict:
    """Run full pipeline: snapshot → report → push → sync."""
    import sys
    if scripts_dir:
        sys.path.insert(0, scripts_dir)

    from portfolio_daily_update import clone_holdings, run_pipeline

Technical Analysis

The tool factory accepts scripts_dir as a string and inserts it at index zero of the process-wide sys.path. No validation confirms that the directory is the expected engine directory, that it is immutable, or that it is not controlled through a symbolic link or writable location.

Python executes module-level code when importing portfolio_daily_update. Because the supplied directory is placed before all existing import locations, a file named portfolio_daily_update.py in that directory takes precedence over the legitimate engine module.

The mutation also persists in the global interpreter state. Repeated tool construction can leave attacker-controlled paths in sys.path, potentially influencing unrelated imports performed later by the same Agent process.

Attack Path

1. An attacker obtains the ability to influence scripts_dir or place files in the directory supplied by the integration.
2. The attacker creates a malicious portfolio_daily_update.py containing module-level payload code and functions ...[truncated 995 chars]

Remediation

View remediation

Remediation Suggestions

• Do not prepend a caller-provided directory to global sys.path.
• Derive the engine location from a fixed, trusted installation root and resolve it with Path.resolve().
• Verify that the resolved path is beneath the expected application directory and reject symbolic-link escapes or unexpected writable locations.
• Import the engine through a packaged, absolute module name installed with the application.
• If file-based loading is unavoidable, load one explicitly identified file and verify its expected hash or signature before execution.
• Avoid persistent global import-path mutation; use a narrowly scoped loader and restore any temporary interpreter state.
• Ensure engine directories and modules are not writable by less-privileged users or externally controlled processes.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: tools/portfolio_tools.py:30

Finding

Path Traversal in Snapshot Date Parameter

Content

View full analysis

Vulnerability Details

File Location: tools/portfolio_tools.py:30-35
Vulnerability Type: Directory traversal and unauthorized local file read
Risk Level: Medium

Vulnerable Code:

python

# Load snapshot
snapshot = None
if date and snapshots_dir.exists():
    snap_file = snapshots_dir / f"{date}.json"
    if snap_file.exists():
        snapshot = json.loads(snap_file.read_text())
elif snapshots_dir.exists():

Technical Analysis

The date argument is documented as a date in YYYY-MM-DD format, but the implementation does not validate that syntax or parse it as a calendar date. It interpolates the value directly into a filesystem path.

A value containing traversal components such as ../ can cause the resulting path to resolve outside snapshots_dir. The forced .json suffix limits candidate targets to filenames ending in .json, but it does not enforce containment within the intended snapshot directory.

The selected file is read and parsed as JSON. Snapshot-shaped data is then copied into the tool response. Unexpected JSON structures may also cause unhandled exceptions, producing a denial of service for the tool invocation.

Attack Path

1. An attacker or model-controlled caller supplies a crafted date argument containing directory traversal components.
2. For example, a value shaped like ../../known/location/file produces a path ending in ../../known/location/file.json.
3. The operating system resolves the traversal outside the configured snapshots directory.
4. If the target exists and is readable by the Agent process, the code reads and parses it.
5. If the JSON contains fields expected from a snapshot, selected data is returned to the caller; malformed or incompatible data may instead disrupt execution.

Impact Assessment

Exploitation can read known local JSON files accessible to the Agent account and outside the intended portfolio snapshot directory. Retur ...[truncated 468 chars]

Remediation

View remediation

Remediation Suggestions

• Validate the input against a strict date pattern such as ^\d{4}-\d{2}-\d{2}$.
• Parse the validated string with datetime.date.fromisoformat() to reject impossible calendar dates.
• Resolve both the snapshot root and candidate path, then confirm that the candidate remains beneath the snapshot root using Path.relative_to() or an equivalent containment check.
• Reject absolute paths, path separators, traversal components, null bytes, and any non-date input.
• Handle JSON parsing and schema errors explicitly without exposing unrelated file contents or internal paths.
• Apply a strict snapshot schema before copying fields into the tool response.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 8)May include surrounding context.

sh

# Usage:
#   bash setup.sh [target_dir]
#
# After running, follow instructions to configure config.json and .env
set -euo pipefail

TARGET="${1:-portfolio-daily-tracker}"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 36)May include surrounding context.

sh

# Usage:
#   bash setup.sh [target_dir]
#
# After running, follow instructions to configure config.json and .env
set -euo pipefail

TARGET="${1:-portfolio-daily-tracker}"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 37)May include surrounding context.

sh

# Usage:
#   bash setup.sh [target_dir]
#
# After running, follow instructions to configure config.json and .env
set -euo pipefail

TARGET="${1:-portfolio-daily-tracker}"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 38)May include surrounding context.

sh

# Usage:
#   bash setup.sh [target_dir]
#
# After running, follow instructions to configure config.json and .env
set -euo pipefail

TARGET="${1:-portfolio-daily-tracker}"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 54)May include surrounding context.

sh

# Usage:
#   bash setup.sh [target_dir]
#
# After running, follow instructions to configure config.json and .env
set -euo pipefail

TARGET="${1:-portfolio-daily-tracker}"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill declares setup steps, environment variables, and file-manipulating behavior, but it does not declare an explicit tool/permission scope. That increases the chance an agent will grant broader file or environment access than necessary, making accidental reads of sensitive portfolio data or webhook/API secrets more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The top-level description is broad enough to activate on ordinary investing conversations, including ambiguous requests about holdings, rebalancing, or returns. In a skill that can modify files and trigger pipelines, over-broad activation increases the risk of unintended state-changing actions on a user's portfolio data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation conditions list many positive triggers but lacks negative examples and boundaries for when the skill should not run. In context, this is risky because the skill can update holdings, set cash/fund values, and remove positions, so ambiguous phrasing could cause the wrong workflow to execute.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The trigger and operational guidance are presented as mandatory Chinese-language phrases and examples, and the skill repeatedly assumes Chinese user expressions for operation parsing. There is no explicit option for the user to choose another language or locale, which may violate language-choice policy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The command examples perform direct state-changing operations on portfolio data, including updates and deletions, without a prominent warning that these actions modify persistent files and may remove holdings. Because the skill interprets natural language trade instructions, users may not realize that casual phrasing can trigger irreversible or hard-to-audit portfolio changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The daily pipeline includes pushing generated portfolio reports to Feishu or Telegram, but it does not warn that sensitive financial holdings, valuations, and P&L data may be transmitted to third-party services. This creates a real confidentiality risk, especially if webhook URLs or bot tokens are misconfigured, shared channels are used, or recipients are broader than intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger conditions are broad enough to match ordinary investing conversation, which can cause unintended activation of a skill that performs portfolio reads and writes. In this skill's context, accidental activation is more dangerous because the documented workflows include modifying holdings, fund values, and cash balances, potentially altering financial records without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs the agent to run commands that update, remove, or overwrite holdings, fund, and cash data, but it does not clearly warn that these are persistent write operations against portfolio files. In a financial tracking skill, hidden or poorly disclosed state changes are risky because user phrasing could be misparsed and permanently corrupt records, especially with commands like update, remove, set-fund, and set-cash.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The message templates on these lines are entirely in Chinese, which imposes a specific language on end users. Under the stated policy, locale or language constraints should either be optional, user-selectable, or clearly documented as justified for a region-specific tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The tool metadata uses Chinese descriptions for the tool and its parameters, which imposes a specific language/locale in the natural-language interface. There is no indication that users can choose language or that the locale restriction is intentional and justified for a region-specific deployment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code prepends a caller-supplied scripts directory to sys.path and then imports executable code from it. If an attacker can influence scripts_dir or the filesystem contents there, they can achieve arbitrary code execution inside the agent process, which is especially dangerous in a portfolio-management skill with access to sensitive financial data and state-changing operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The tool writes updated holdings to storage via save_holdings when changes are detected, which can affect user data. Although the tool description says it updates holdings, this function contains no confirmation prompt, visible logging/print, or inline warning/comment disclosing that persisted portfolio data will be changed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The update_holdings tool name metadata and parameter descriptions are presented only in Chinese. Without opt-in, language selection, or justification, this creates a natural-language locale restriction that may violate organizational language-choice policy.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This pipeline tool again modifies sys.path based on external input and imports workflow functions that are then executed, combining arbitrary-code-loading with immediate side effects. In this skill context, exploitation could not only run attacker code but also trigger reports, pushes, and dashboard sync actions affecting external systems and leaking portfolio information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This tool clones holdings and runs a pipeline described as snapshot, report, push, and sync, which likely includes file writes and external push/sync actions. The code does not include a confirmation prompt, visible user disclosure, or warning comment/docstring about these side effects before execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The pipeline tool description and parameter text are only in Chinese, including the push-report parameter. This enforces a locale choice in the user-facing interface without offering an alternative language or stating a justified regional limitation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest requests an optional OPENAI_API_KEY for 'AI chat features' that are not justified by the documented portfolio-tracking workflow or listed tools. Unnecessary secret collection expands the attack surface: if downstream scripts or cloned repos use the key unexpectedly, it could enable data exfiltration, unauthorized API use, or hidden secondary processing of portfolio data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The main manifest describes a daily portfolio tracker with snapshots, reports, analytics, and notifications. Mentioning an 'AI chat, backtesting engine' in the release notes suggests additional analytical capability beyond the declared daily-tracker purpose, without corresponding explanation in the manifest or usage sections.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description focuses on portfolio tracking, snapshots, pricing, analytics, and push notifications. Declaring an OpenAI API key for separate 'AI chat features' introduces a broader conversational/LLM capability that is not described as part of the skill's purpose and is not necessary to perform the documented portfolio operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description presents the skill as a daily portfolio tracker and reporting pipeline. Mentioning an 'AI chat, backtesting engine' adds an analysis/simulation capability that is materially broader than daily tracking and reporting, and that broader capability is not declared in the manifest description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.