T09 · Insecure Skill Coding Practices
Warning
- Location
market_intel.py:309- Finding
Custom News Endpoints Permit Plaintext Transmission of API Credentials and User Queries
- Content
View full analysis
- Remediation
View remediation
Security audit
我的技能
Security checks for vulnerabilities and agentic risk
Overview
This market-intelligence skill is mostly purpose-aligned, but its custom news endpoints can send user queries and optional API tokens to unrestricted URLs, including non-HTTPS endpoints.
Review before installing if you handle confidential watchlists, investment theses, or paid API credentials. Use only trusted HTTPS custom endpoints for BOCHA_BASE_URL and MINIMAX_BASE_URL, avoid placing secrets in environments shared with untrusted tools, and disable unneeded news sources with the command-line source options.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
Tainted flow: 'req' from os.getenv (line 134, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python for i in range(max(1, retries + 1)): req = urllib.request.Request(url=url, method=method, headers=merged_headers, data=data) try: with urllib.request.urlopen(req, timeout=timeout) as resp: body = resp.read().decode("utf-8", errors="ignore") obj = {} if not body else json.loads(body) if use_cache:
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The custom news integration POSTs user queries to an arbitrary externally configured base URL, which could point to any host under operator or attacker control. This creates a clear exfiltration path for sensitive user research queries and may also leak bearer tokens to untrusted infrastructure if misconfigured.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill invokes a Python script and advertises use of environment variables plus multiple external data sources, which implies network and environment access, yet it declares no explicit tool scope or permissions boundary. This creates an unnecessary trust gap: the runtime may grant broader capabilities than users or reviewers expect, enabling overbroad file, network, or secret access if the script is modified or behaves unexpectedly.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest description and the entire markdown guidance force a specific language/locale for interaction, which matches the policy category for language or locale constraints without user opt-in. There is no indication that users may choose another language or that the Chinese-only requirement is justified by a region-specific purpose.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest describes a data/intelligence retrieval skill for stock quotes, news tracking, and cross-source verification. However, the code explicitly supports a separate 'strategy' mode with predefined trading-analysis strategies and outputs actions such as bullish, bearish, offense, defense, risk-on, and risk-off, which goes beyond merely fetching and structuring market/news information.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 81% confidence
- Finding
This code transmits user search queries and an API credential to an external provider, which is expected for the feature but still creates a real data-exposure boundary. In a market-intelligence skill, outbound news searches can reveal user interests, positions, or proprietary investigative targets to the third party.
- Content
python raise RuntimeError("缺少 TAVILY_API_KEY") payload = {"query": query, "max_results": max_results, "topic": "news"} headers = {"Content-Type": "application/json", "Authorization": f"Bearer {api_key}"} data = http_json("https://api.tavily.com/search", method="POST", headers=headers, payload=payload) items = [] for r in data.get("results", []): items.append(
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The SerpAPI news request forces
hl=zh-cnandgl=cn, which constrains language and region behavior regardless of user preference. This is a natural-language policy concern because the file does not offer opt-in, user selection, or justification for enforcing a Chinese locale.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 81% confidence
- Finding
The Brave integration sends user queries to an external news API using an account token, creating a third-party disclosure channel. While intended for functionality, it remains a privacy/security concern because financial-research queries may be sensitive and are sent without in-band warning.
- Content
python raise RuntimeError("缺少 BRAVE_API_KEY") qs = urllib.parse.urlencode({"q": query, "count": max_results}) headers = {"X-Subscription-Token": api_key, "Accept": "application/json"} data = http_json(f"https://api.search.brave.com/res/v1/news/search?{qs}", headers=headers) items = [] for r in data.get("results", [])[:max_results]: items.append(
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
User-supplied news queries are forwarded to external search providers without any disclosure, consent, or sanitization boundary. In this skill context, queries may contain watchlists, proprietary company names, investment theses, or other sensitive research intent, so silent transmission to third parties meaningfully increases privacy and confidentiality risk.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The skill silently persists fetched market/news responses to a local JSON cache file, which is not disclosed by the read-oriented description. If user queries or provider-returned content are sensitive, this creates an unexpected local data retention surface that could expose prior requests and results to other local users or processes.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
To perform its work, the skill reads multiple API keys and custom base URLs from environment variables, including arbitrary custom providers via source-specific BASE_URL settings. While provider credentials can be expected for external news access, the generic custom-provider mechanism expands the capability beyond the manifest's narrowly described stock/news intelligence role.
- Content