T03 · Remote Payload Retrieval and Execution
Error
- Location
QUICKSTART.md:159- Finding
Unverified Remote Installer Is Downloaded and Executed Directly
- Content
View full analysis
- Remediation
View remediation
Security audit
初始版本：支持 28+ 新闻源、10+ LLM 模型、情感分析、图表生成、数据持久化、定时任务
Security checks for vulnerabilities and agentic risk
Overview
This finance-analysis skill needs review because its main workflow presents hard-coded, randomly labeled mock financial analysis as a successful live report.
Do not rely on this skill for real investment research in its current form. Before installing or using it, require the publisher to replace the mock/random primary workflow, remove pipe-to-shell installer guidance, clearly disclose what data is sent to model providers and stored locally, and make scheduling/export behavior opt-in and bounded.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
other
Warning
- Location
scripts/analyze_sentiment.py:125- Finding
Untrusted News Content Can Perform Indirect Prompt Injection
- Content
View full analysis
str: """Build the sentiment-analysis prompt""" title = news_item.get('title', '') summary = news_item.get('summary', '') source = news_item.get('source', '') prompt = f"""You are a professional financial analyst. Analyze the sentiment of the following news. **News title**: {title} **News summary**: {summary} **News source**: {source} Return the analysis in the following JSON format: ```json {{ "sentiment": "positive|negative|neutral", "sentiment_score": 0-100, "confidence": "high|medium|low", "sentiment_label": "🟢|🔴|⚪", "key_points": ["key point 1", "key point 2"], "affected_sectors": ["sector 1", "sector 2"], "affected_stocks": [{{"ticker": "ticker", "impact": "positive|negative|neutral"}}], "timeframe": "short|medium|long", "reasoning": "reasoning within 50 characters" }} ``` Analysis rules: 1. Positive signals: revenue above expectations, new products, major contracts, policy support, insider buying, and similar events 2. Negative signals: revenue below expectations, recalls, executive departures, penalties, increased competition, and similar events 3. Neutral signals: results in line with expectations, routine business, and unverified rumors 4. Confidence: official announcement or authoritative media is high, mainstream media is medium, and social media or rumors are low 5. Timeframe: product launches or contracts are short term, earnings or strategy are medium term, and technological or policy changes are long term Return JSON directly without any other content.""" return prompt def analyze_with_openai(client: OpenAI, model: str, prompt: str) -> Dict[str, Any]: """Anal ...[truncated 2390 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/database.py:354- Finding
Untrusted Database Values Are Exported Without Spreadsheet Formula Neutralization
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.py:95- Finding
Primary Workflow Presents Random Mock Data as Successful Financial Analysis
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (96)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
检查文件大小
ls -lh reports/
删除大文件
rm reports/*.png
text ---
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The quickstart recommends piping a remotely fetched script directly into sh, which executes unreviewed code from the network immediately on the user's system. If the remote server, connection, distribution path, or install script is compromised, this can lead to arbitrary code execution with the user's privileges.
- Content
Q: 本地模型怎么安装？
bash # 1. 安装 Ollama curl -fsSL https://ollama.com/install.sh | sh # 2. 下载模型 ollama pull llama3.1
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The use of a shell pipeline into sh amplifies the risk of chaining abuse because it removes any opportunity for the user to inspect the fetched content before execution. In documentation intended for broad use, this pattern normalizes a dangerous practice and makes compromise of the upstream content immediately exploitable.
- Content
Q: 本地模型怎么安装？
bash # 1. 安装 Ollama curl -fsSL https://ollama.com/install.sh | sh # 2. 下载模型 ollama pull llama3.1
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 87% confidence
- Finding
This variant includes a meaningful security concern: the skill allegedly performs local file writes while declaring no permissions, and it may misrepresent mocked or placeholder behavior as real analysis. Hidden write capability combined with undocumented execution behavior can lead to unauthorized file creation/modification and unsafe trust assumptions by users or the host environment.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This variant includes a meaningful security concern: the skill allegedly performs local file writes while declaring no permissions, and it may misrepresent mocked or placeholder behavior as real analysis. Hidden write capability combined with undocumented execution behavior can lead to unauthorized file creation/modification and unsafe trust assumptions by users or the host environment.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This variant includes a meaningful security concern: the skill allegedly performs local file writes while declaring no permissions, and it may misrepresent mocked or placeholder behavior as real analysis. Hidden write capability combined with undocumented execution behavior can lead to unauthorized file creation/modification and unsafe trust assumptions by users or the host environment.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This variant includes a meaningful security concern: the skill allegedly performs local file writes while declaring no permissions, and it may misrepresent mocked or placeholder behavior as real analysis. Hidden write capability combined with undocumented execution behavior can lead to unauthorized file creation/modification and unsafe trust assumptions by users or the host environment.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `scheduler.py` | 定时任务（自动运行） | 无 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `scheduler.py` | 定时任务（自动运行） | 无 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `scheduler.py` | 定时任务（自动运行） | 无 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `scheduler.py` | 定时任务（自动运行） | 无 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `scheduler.py` | 定时任务（自动运行） | 无 |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `scheduler.py` | 定时任务（自动运行） | 无 |
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The command
curl -fsSL https://ollama.com/install.sh | shfetches and immediately executes a remote script without verification. If the remote host, transport chain, or script content is compromised, users could execute arbitrary code on their machine; in a skill document, this is more dangerous because users may copy-paste it verbatim as trusted setup guidance.- Content
Windows/macOS/Linux:
bash # 下载安装 curl -fsSL https://ollama.com/install.sh | sh # 或使用 Docker docker run -d -v ollama:/root/.ollama -p 11434:11434 --name ollama ollama/ollama
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Piping
curloutput directly intoshis a classic command-chaining anti-pattern that removes any review or integrity check before execution. A compromised script or MITM-adjacent failure in the delivery path could lead to immediate arbitrary command execution with the user's privileges.- Content
Windows/macOS/Linux:
bash # 下载安装 curl -fsSL https://ollama.com/install.sh | sh # 或使用 Docker docker run -d -v ollama:/root/.ollama -p 11434:11434 --name ollama ollama/ollama
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python 请直接输出 JSON，不要有其他内容。""" return prompt def analyze_with_openai(client: OpenAI, model: str, prompt: str) -> Dict[str, Any]:
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill advertises deep cross-source financial analysis, company and industry evaluation, and professional brief generation, but the implementation is mostly placeholder logic that reuses mock analysis and stub report generators. This mismatch is dangerous because it can create false trust in the system's sophistication and accuracy, leading users to act on unsupported financial conclusions.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The function labeled as sentiment analysis assigns random sentiment, confidence, and impact values instead of performing any real analysis. In a financial-news skill, this can directly mislead users into making investment decisions based on fabricated outputs, which is especially dangerous because the script presents the results as authoritative analysis.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script claims to fetch live news from specified sources but instead bypasses fetching and analyzes hard-coded sample articles. This creates deceptive output that appears timely and source-based when it is not, which is particularly risky in a finance context where users may rely on recency and source coverage for trading or risk decisions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The feature list advertises SQLite persistence, CSV/JSON export, scheduled execution, and external model/API integrations, but gives no warning that news content, derived analysis, or user-provided inputs may be stored locally, transmitted to third-party LLM providers, or processed automatically on a schedule. In a finance-analysis skill, this omission can mislead users about confidentiality, retention, and autonomous outbound activity, increasing the risk of unintended data disclosure and privacy/compliance issues.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The quickstart explicitly instructs users to configure third-party model providers and run analysis, but it does not warn that news content, tickers, prompts, and possibly derived analysis data may be transmitted to external APIs. This creates a privacy and data-handling transparency issue because users may unknowingly send potentially sensitive research inputs to OpenAI, DashScope, or other providers.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The configuration example sets
default_language: zh, which imposes a specific language preference in natural-language behavior. The file does not indicate that users can choose another language or that the Chinese default is optional, which can violate language/locale choice expectations.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documents capabilities that imply network access, shell execution, filesystem reads/writes, and environment-variable access, but it does not declare any explicit tool scope or permission boundaries. This creates a least-privilege violation: a host may grant broader access than users expect, enabling unintended data access, command execution, or outbound requests if the implementation is invoked as described.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documented scope expands from simple news analysis into persistent storage, export, chart generation, and scheduling. This scope creep matters because persistence and automation materially increase attack surface: stored data can accumulate sensitive information, exports can move data out of expected boundaries, and background scheduled runs can make repeated network/API actions without fresh user intent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Scheduler support is not clearly necessary for an on-demand analysis skill and introduces autonomous execution. If enabled, it can repeatedly fetch data, consume paid APIs, create files, or process user-linked watchlists without real-time confirmation, increasing the risk of abuse, surprise actions, or persistence of compromised behavior.
- Content
Static analysis
No suspicious patterns detected.