Security audit

Vnstock Free Expert

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a Vietnam stock-analysis workflow, but one helper exposes overly broad local Python invocation and the credential handling can leak API keys into logs or output files.

Review before installing. Use this only in an isolated environment, avoid passing API keys with --api-key, do not feed untrusted arguments to invoke_vnstock.py, and pin/review vnstock dependencies before following the install docs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/invoke_vnstock.py:58
Finding: Unrestricted Dynamic Invocation Enables Arbitrary Local Command Execution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/run_pipeline.py:9
Finding: API Keys May Be Exposed Through Process Arguments, Logs, and Invocation Artifacts
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/vnstock/11-best-practices.md:43
Finding: Documentation Recommends Unsafe Pickle Deserialization from Predictable Cache Files
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/vnstock/02-installation.md:11
Finding: Installation Guidance Uses Unpinned Packages and a Mutable Git Repository Head
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (55)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the implemented behavior is only ranking/scoring from preexisting CSVs while the description promises vnstock API usage and free-tier safety enforcement, the mismatch is still a true vulnerability because it conceals the real operational boundaries. Misleading descriptions reduce the effectiveness of human and automated review and can mask stale-data workflows or unvalidated downstream assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the implemented behavior is only ranking/scoring from preexisting CSVs while the description promises vnstock API usage and free-tier safety enforcement, the mismatch is still a true vulnerability because it conceals the real operational boundaries. Misleading descriptions reduce the effectiveness of human and automated review and can mask stale-data workflows or unvalidated downstream assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the implemented behavior is only ranking/scoring from preexisting CSVs while the description promises vnstock API usage and free-tier safety enforcement, the mismatch is still a true vulnerability because it conceals the real operational boundaries. Misleading descriptions reduce the effectiveness of human and automated review and can mask stale-data workflows or unvalidated downstream assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the implemented behavior is only ranking/scoring from preexisting CSVs while the description promises vnstock API usage and free-tier safety enforcement, the mismatch is still a true vulnerability because it conceals the real operational boundaries. Misleading descriptions reduce the effectiveness of human and automated review and can mask stale-data workflows or unvalidated downstream assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: If the implemented behavior is only ranking/scoring from preexisting CSVs while the description promises vnstock API usage and free-tier safety enforcement, the mismatch is still a true vulnerability because it conceals the real operational boundaries. Misleading descriptions reduce the effectiveness of human and automated review and can mask stale-data workflows or unvalidated downstream assumptions.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/vnstock/01-overview.md (reported line 390)May include surrounding context.
md
**Trạng thái:** Chưa triển khai đầy đủ - **Layer 5 (Analytics)**: Chỉ số kỹ thuật, mô hình định giá, vv (chưa đầy đủ) - có thư viện vnstock_ta cung cấp tính toán bộ chỉ báo kỹ thuật. - **Layer 6 (Macro)**: Chỉ số kinh tế, hàng hóa - chỉ có trong thư viện vnstock_data yêu cầu tham gia gói tài trợ Vnstock. - **Layer 7 (Insights)**: Screener, rankings top stocks, vv - (Chưa đầy đủ) - chỉ có trong thư viện vnstock_data yêu cầu tham gia gói tài trợ Vnstock.

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

Category: YARA Match
Confidence: 89% confidence
Finding: The documentation recommends installing directly from a GitHub repository using 'pip install git+https://...', which executes setup/build logic from a remote source outside a pinned, reviewed package release. In an agent skill context, remote bootstrap instructions are more dangerous because users may follow them automatically, increasing supply-chain risk if the repository, dependency chain, or branch state is compromised.
Content: Scanner excerpt · references/vnstock/02-installation.md (reported line 20)May include surrounding context.
02 - Cài Đặt & Cấu Hình

📦 Yêu Cầu Hệ Thống

Python: 3.8 hoặc cao hơn (khuyến nghị 3.10+)

OS: Windows, macOS, hoặc Linux

Internet: Kết nối internet ổn định

🚀 Cài Đặt Nhanh

Option 1: Cài từ PyPI (Stable)

bash
pip install vnstock

Option 2: Cài từ GitHub (Latest Development)

bash
pip install git+https://github.com/vnstock-lab/vnstock.git

Option 3: Cài từ Local (Dev Version)

bash
# Clone hoặc copy thư mục private_packages pip install git+https://github.com/vnstock-lab/vnstock.git

📋 Dependencies

VNStock phụ thuộc vào các package sau:

text
pandas>=1.3.0 # Xử lý DataFrame requests>=2.25.0 # HTTP requests beautifulsoup4>=4.9.0 # Web scraping lxml>=4.6.0 # XML parsing pydantic>=1.8.0 # Data validation tenacity>=8.0.0 # Retry logic python-dateutil>=2.8.0 # Date utilities aiohttp>=3.7.0

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The snippet shows external API keys stored in a .env file, which is a legitimate pattern, but the documentation does not sufficiently warn that these values are credentials requiring protection. In a skill used by agents and users, this can lead to secret leakage through accidental commits, logs, prompt sharing, or unsafe local storage.
Content: Scanner excerpt · references/vnstock/02-installation.md (reported line 197)May include surrounding context.
Nếu sử dụng external APIs như FMP, XNO, DNSE:

bash
# .env file FMP_API_KEY=your_fmp_api_key_here XNO_API_KEY=your_xno_api_key_here DNSE_API_KEY=your_dnse_api_key_here

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/vnstock/10-connector-guide.md (reported line 77)May include surrounding context.
FMP_API_KEY = os.getenv('FMP_API_KEY')

if not FMP_API_KEY: print("❌ Please set FMP_API_KEY in .env") else: print("✅ FMP_API_KEY configured")

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/vnstock/10-connector-guide.md (reported line 133)May include surrounding context.
FMP_API_KEY = os.getenv('FMP_API_KEY')

if not FMP_API_KEY: print("❌ Please set FMP_API_KEY in .env") else: print("✅ FMP_API_KEY configured")

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/vnstock/10-connector-guide.md (reported line 169)May include surrounding context.
FMP_API_KEY = os.getenv('FMP_API_KEY')

if not FMP_API_KEY: print("❌ Please set FMP_API_KEY in .env") else: print("✅ FMP_API_KEY configured")

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 139)May include surrounding context.
python
FMP_API_KEY = os.getenv('FMP_API_KEY') if not FMP_API_KEY: print("❌ Please set FMP_API_KEY in .env") else: print("✅ FMP_API_KEY configured") ```

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/vnstock/02-installation.md (reported line 161)May include surrounding context.
md
if env_key: return env_key.strip() # Skill-local fallback: <skill_root>/.env # scripts/common.py -> skill root is parents[1] env_path = Path(__file__).resolve().parents[1] / ".env" values = _read_env_file(env_path)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/vnstock/02-installation.md (reported line 392)May include surrounding context.
md
if env_key: return env_key.strip() # Skill-local fallback: <skill_root>/.env # scripts/common.py -> skill root is parents[1] env_path = Path(__file__).resolve().parents[1] / ".env" values = _read_env_file(env_path)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/vnstock/02-installation.md (reported line 393)May include surrounding context.
md
if env_key: return env_key.strip() # Skill-local fallback: <skill_root>/.env # scripts/common.py -> skill root is parents[1] env_path = Path(__file__).resolve().parents[1] / ".env" values = _read_env_file(env_path)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/vnstock/02-installation.md (reported line 440)May include surrounding context.
md
if env_key: return env_key.strip() # Skill-local fallback: <skill_root>/.env # scripts/common.py -> skill root is parents[1] env_path = Path(__file__).resolve().parents[1] / ".env" values = _read_env_file(env_path)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/vnstock/10-connector-guide.md (reported line 424)May include surrounding context.
md
if env_key: return env_key.strip() # Skill-local fallback: <skill_root>/.env # scripts/common.py -> skill root is parents[1] env_path = Path(__file__).resolve().parents[1] / ".env" values = _read_env_file(env_path)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/vnstock/11-best-practices.md (reported line 331)May include surrounding context.
md
if env_key: return env_key.strip() # Skill-local fallback: <skill_root>/.env # scripts/common.py -> skill root is parents[1] env_path = Path(__file__).resolve().parents[1] / ".env" values = _read_env_file(env_path)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/vnstock/11-best-practices.md (reported line 337)May include surrounding context.
md
if env_key: return env_key.strip() # Skill-local fallback: <skill_root>/.env # scripts/common.py -> skill root is parents[1] env_path = Path(__file__).resolve().parents[1] / ".env" values = _read_env_file(env_path)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 137)May include surrounding context.
python
if env_key: return env_key.strip() # Skill-local fallback: <skill_root>/.env # scripts/common.py -> skill root is parents[1] env_path = Path(__file__).resolve().parents[1] / ".env" values = _read_env_file(env_path)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The implementation contradicts the skill description by exposing arbitrary module/class/method invocation and serializing whatever result is returned. That mismatch is dangerous because operators may trust the skill as a narrowly scoped, free-tier-safe stock workflow while it actually behaves as a general-purpose reflection wrapper with file output.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Allowing an arbitrary module path to be imported is unjustified for a Vietnam stock analysis skill and greatly broadens the attack surface. It enables the script to load non-VNStock modules and combine them with reflective class/method access, effectively escaping the intended domain constraints.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises executable scripts, shell commands, filesystem outputs, optional environment-variable loading from .env, and internet-backed API usage, but it declares no explicit tool scope or permissions boundaries. In an agent environment, that mismatch can allow broader-than-expected shell, file, and secret access, increasing the risk of unsafe execution paths or unintended exposure of local data and API keys.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The API key example shows direct key configuration without any warning about secure secret handling, storage, rotation, or redaction. In practice, users may hardcode credentials in code, logs, notebooks, or skill configs, increasing the risk of credential leakage and unauthorized third-party API usage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document describes web scraping and third-party API access, but does not clearly warn that using the skill will initiate outbound network requests to external services. In an agent skill context, this can cause users or downstream systems to unknowingly transmit metadata, prompts, symbols, or credentials to third parties, creating privacy, compliance, and trust risks.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tp4

Tp4

Tp4

Tp4

Tp4

Hidden Instructions

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

02 - Cài Đặt & Cấu Hình

📦 Yêu Cầu Hệ Thống

🚀 Cài Đặt Nhanh

Option 1: Cài từ PyPI (Stable)

Option 2: Cài từ GitHub (Latest Development)

Option 3: Cài từ Local (Dev Version)

📋 Dependencies

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Description-Behavior Mismatch

Context-Inappropriate Capability

Undeclared Tool Scope

Missing User Warnings

Missing User Warnings