T08 · Insecure Dependencies
Warning
- Location
app.py:24- Finding
Execution of an Unverified External Script
- Content
View full analysis
- Remediation
View remediation
Security audit
A Share Dashboard
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a local A-share stock dashboard, but it silently depends on and executes an unverified Python script from another skill path outside the reviewed package.
Review this before installing. The main concern is not obvious malware, but that the dashboard runs another Python script from a separate local skill path that was not part of this reviewed package. Only use it if you trust and can verify the installed a-share-stock-dossier skill, and avoid entering sensitive portfolio details unless you understand where the data is processed and sent.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill instructs users to run a local Streamlit app via shell commands, but the manifest does not declare any tool scope or permissions boundary. This creates an ambiguity gap where execution capability exists without explicit disclosure, making it harder for users or platforms to assess what local actions the skill may require or trigger.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code file contains natural-language UI and documentation strings that force a specific language/locale experience. Under the policy, language restrictions should either provide user opt-in/choice or be clearly justified as region-specific; the file does not do so.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill is described as a web dashboard for A-share analysis, hotspot annotation, and position monitoring. While fetching market data is expected, spawning a separate Python process with subprocess introduces a general code-execution capability that is not an obvious requirement of the stated dashboard purpose.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python if with_indices: cmd.append("--with-indices") result = subprocess.run(cmd, capture_output=True, text=True, timeout=60) if result.returncode != 0: return None return json.loads(result.stdout)
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The entire skill description and UI terminology are presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to Chinese-speaking users. Under the language/locale policy, a forced language without user opt-in can be a natural-language policy violation unless clearly justified.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The skill asks users to enter portfolio holdings data but does not clearly disclose how that sensitive financial information is processed, stored, or whether any of it could be transmitted through external APIs used by the dashboard. Even if the intended use is local-only, lack of transparency can expose users to privacy and confidentiality risks.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The manifest describes a stock analysis dashboard, but the code explicitly integrates and runs '/skills/a-share-stock-dossier/scripts/a_share_snapshot.py' from another skill/workspace. This creates cross-skill execution behavior not reflected in the dashboard description, making the implementation broader than a self-contained web dashboard.
- Content