Security audit

金融市场数据质量校验工具

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real market-data checker, but it can automatically email validation details to a fixed recipient using a hard-coded SMTP credential.

Review before installing. Do not use this skill with sensitive JSON files unless email alerts are disabled or rebuilt to require explicit opt-in, configurable recipients, redaction, and secret-based configuration. The embedded SMTP credential should be revoked and removed, and imports should be made package-relative so validators load only from the installed skill.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/check_data.py:44
Finding: Hard-Coded SMTP Authentication Credential
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/check_data.py:165
Finding: Automatic Transmission of Validation Data to a Fixed External Recipient
Content: View full analysis
str: """将 issues 列表格式化为可读字符串""" if not issues: return "无问题" lines = [] for i, issue in enumerate(issues, 1): lines.append( f"{i}. [{issue['rule']}] {issue['category']} > {issue['key']}\n" f" 值：{str(issue['value'])[:80]}\n" f" 原因：{issue['message']}" ) return "\n".join(lines) ``` ### Technical Analysis The command-line interface accepts an arbitrary JSON path through `--file`. When validation continues to fail after the configured retry attempts, `_format_issues()` includes each issue's key, message, and the first 80 characters of its value in an email body. The email is then sent automatically to the hard-coded recipient configured in `CONFIG`. There is no explicit runtime consent, recipient confirmation, redaction policy, allowlist, or switch that disables outbound transmission. Email alerting is mentioned in the Skill documentation, so the network behavior is not fully con ...[truncated 1246 chars]
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Warning

Location: scripts/check_data.py:19
Finding: Module Hijacking Through External Workspace Import Precedence
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a local data-quality checker, but the documentation also reveals outbound SMTP email alerts, fixed recipients/senders, and filesystem activity outside the core task. Undisclosed external transmission and broader local access materially expand the attack surface and can leak sensitive validation results or market data context to third parties.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a local data-quality checker, but the documentation also reveals outbound SMTP email alerts, fixed recipients/senders, and filesystem activity outside the core task. Undisclosed external transmission and broader local access materially expand the attack surface and can leak sensitive validation results or market data context to third parties.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a local data-quality checker, but the documentation also reveals outbound SMTP email alerts, fixed recipients/senders, and filesystem activity outside the core task. Undisclosed external transmission and broader local access materially expand the attack surface and can leak sensitive validation results or market data context to third parties.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file embeds live SMTP configuration and an authentication secret directly in source code, while also enabling outbound email transmission. Hard-coded credentials are easily leaked through source control, logs, backups, or reuse across environments, and they provide a built-in channel for unauthorized external communication.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Automatic alert email transmission combined with hard-coded SMTP credentials is not disclosed through a clear user-facing safety notice or consent mechanism. In the context of a data-quality checker, this hidden network behavior increases the risk of silent data leakage and unauthorized use of embedded credentials.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is presented as a local market-data quality checker, but it transmits alert content externally via SMTP. Those emails can include file paths and detailed validation issues, creating an unjustified data exfiltration path for potentially sensitive business or market data and violating least-privilege expectations for a local validation tool.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documentation describes file-reading behavior but does not declare any explicit tool scope or permissions boundary. In an agent setting, missing scope declarations increase the chance of over-broad file access, unexpected data exposure, or misuse beyond the intended market_data.json target.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill advertises automatic alert emails without clearly warning that validation details may be transmitted externally. This undermines informed consent and can expose operational or market-sensitive data through outbound messaging that users may not expect from a local checker.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The configuration exposes fixed sender and recipient email addresses and SMTP details without a clear warning or consent flow for outbound communication. In context, this is more dangerous because the skill claims to be a data-quality tool, so users may not anticipate external transmission of potentially sensitive content or operational metadata.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Embedding hard-coded email alerting in documentation for a local validation skill introduces an unrelated exfiltration channel. Even if intended for operational alerting, fixed external recipients and mail infrastructure can send potentially sensitive data-quality failures, filenames, or business information outside the expected execution boundary.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The module title and descriptive text are written entirely in Chinese and describe the tool behavior without indicating any language choice or locale opt-in. This can violate language/locale policy when a skill implicitly enforces one language for user-visible behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The docstring states the checker 'uniformly returns' results, but the implementation also performs side effects including persistent logging and external email alerts. This mismatch is security-relevant because operators or users may trust it as a pure local validation component, while it actually writes sensitive operational details to disk and can transmit them externally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file’s natural-language instructions, field names, and validation messages are exclusively in Chinese, indicating the checker is designed around a fixed Chinese-language schema and output style. There is no indication of user choice, opt-in, or documented region-specific justification for enforcing this locale, which matches the language/locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python file contains natural-language documentation entirely in Chinese, and the generated validation messages are also hard-coded in Chinese. Under the stated policy, forcing a specific language without user opt-in or documented locale justification is a language/locale policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The checker emits failure messages and categories only in Chinese, which constrains downstream user-visible output to a single language. The file does not provide any opt-in, fallback, or justification for this locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module docstring and user-facing rule descriptions are entirely in Chinese, and the file provides no indication that language choice is configurable or that the skill is intentionally limited to a Chinese-language environment. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file’s natural-language descriptions and messages are entirely in Chinese, including the module docstring and validation rule text. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy violation unless it is clearly documented as region-specific or optional, which is not present here.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This is a real validation flaw: ALLOWED_TYPES = (int, float) combined with isinstance(v, ...) will accept bool values because bool subclasses int in Python. In a market-data quality checker, True/False can silently pass as numeric values (1/0), undermining data integrity checks and potentially causing bad downstream decisions or false acceptance of malformed financial data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest description and trigger phrases are entirely in Chinese, which can amount to a language/locale constraint if the skill expects Chinese-only invocation. There is no indication that users may invoke it in other languages or that the Chinese-only scope is intentional and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code file's natural-language docstrings and operational descriptions are entirely in Chinese, including the skill name and validation rules, with no indication that another language is supported or that Chinese is a justified locale constraint. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module header says all required fields in market_data.json are checked and explicitly lists market metrics 'price / change / volume' as supported structure. However, in _check_market_null at L125-L135, only the 'price' field is enforced as non-empty; 'change' and 'volume' are iterated but never validated, contradicting the documented scope of the null check.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The class documentation states in line L025 that '政策/企业动态列表非空（允许空列表）', which is internally contradictory and implies list-oriented validation. In the implementation at L76-L94, the checker does not validate list non-emptiness at all; instead it accepts only dict-typed values for these fields, creating a clear documentation-to-code mismatch.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The module docstring is written entirely in Chinese, and the class docstring continues that language choice. Under the stated policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file’s natural-language documentation and validation messages are written entirely in Chinese, including the class docstring and user-facing error text. This creates a locale-specific behavior without any visible opt-in or documented justification that the skill is intended only for Chinese-speaking users or a China-specific compliance context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.