Security audit

StockStar ESG - 证券之星企业ESG信息查询

Security checks for vulnerabilities and agentic risk

Overview

This is a transparent Chinese-language tool for looking up public ESG ratings, with expected outbound requests and no persistence or data mutation.

Install this if you are comfortable with a Chinese-language ESG lookup skill sending stock names, codes, and search terms to public financial-data endpoints. Be aware that its broad ESG-related triggers may activate during general ESG discussions, so review outputs for relevance before relying on them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill instructs the agent to invoke a Python CLI that retrieves live data from an external source, but the manifest declares no explicit tool scope or permissions boundary. That mismatch can allow unintended network-capable execution in environments that rely on manifest-level restrictions, increasing the risk of unauthorized outbound requests or tool abuse.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger list contains broad generic terms such as ESG, 评级, 评分, 社会责任, 公司治理, and 可持续发展, which can match many unrelated conversations. Overbroad activation can cause the skill to run unexpectedly, leading to unnecessary external requests, context hijacking, or user confusion when the agent invokes this capability outside its intended scope.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation guidance allows triggering from partial topical mentions without firm disambiguation rules, so the skill may engage whenever users mention ESG-related concepts rather than explicitly requesting stock data. In an agentic environment, ambiguous routing can misfire into network-backed actions, exposing user context to external systems and reducing control over tool invocation.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The module docstring and all user-oriented natural-language descriptions in this file are written exclusively in Chinese, which indicates a language-specific constraint. Under the policy, forcing a specific language without opt-in or justification is a natural-language policy issue.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: This code file contains natural-language documentation and CLI descriptions exclusively in Chinese, including the module docstring and command descriptions. That creates a language policy issue if users are not offered a language choice or an opt-in mechanism for Chinese output.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: The module docstring and function documentation are written entirely in Chinese, which imposes a specific language on maintainers or users reading embedded help text. Under the policy, language constraints should be optional or explicitly justified; this file provides neither opt-in nor a stated region-specific reason.

Static analysis

No suspicious patterns detected.