T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:40- Finding
Unauthenticated Development Server Exposed on All Network Interfaces
- Content
View full analysis
- Remediation
View remediation
Security audit
Yfinance
Security checks for vulnerabilities and agentic risk
Overview
This stock-data skill is mostly coherent, but it can automatically start an unauthenticated FastAPI service exposed on all network interfaces and documents optional persistent systemd deployment.
Install only if you are comfortable running a local market-data web service. Prefer binding it to 127.0.0.1, avoid --reload for normal use, do not expose port 8000 publicly without authentication and rate limits, and treat the systemd instructions as optional deployment guidance requiring separate hardening.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T09 · Insecure Skill Coding Practices
Note
- Location
main.py:22- Finding
Wildcard Cross-Origin Resource Sharing Policy
- Content
View full analysis
- Remediation
View remediation
T06 · System Persistence
Warning
- Location
README.md:194- Finding
Privileged Installation of a Persistent Public-Facing Service
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
main.py:128- Finding
Raw Internal Exceptions Returned to Unauthenticated Clients
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Non-Reproducible Dependency Resolution Using Unbounded Minimum Versions
- Content
View full analysis
=0.110.0 uvicorn[standard]>=0.29.0 yfinance>=0.2.40 pandas>=2.0.0 ``` ### Technical Analysis Every dependency is specified only with a minimum version. A future installation can therefore select any newer release accepted by the resolver. Builds performed at different times may install materially different code without changes to the audited project. The package names and sources shown in the project are consistent with the declared functionality. No typosquatting, dependency-confusion package name, malicious package, or nonstandard package repository was identified. The risk arises from non-reproducible resolution and automatic trust of future releases, rather than from a currently confirmed malicious dependency. Because Python packages execute code during installation and application runtime, a future compromised or unexpectedly incompatible release could affect the host when users follow the documented `pip install -r requirements.txt` instruction. ### Attack Path 1. A dependency publishes a future release that is compromised, vulnerable, or incompatible. 2. A user runs `pip install -r requirements.txt`. 3. The package resolver selects that later release because the requirement has no upper bound or exact pin. 4. Package installation or import executes the newly selected code. 5. The code runs with the privileges of the user performing installation or starting the service. This path is contingent on a future unsafe release; no current compromised version was established during the static audit. ### Impact Assessment The potential privilege level is that of the installation or service account. Under ordinary local installation this is the invoking user; under the documented systemd deployment, runtime dependency code executes as `azureuser`. If a ...[truncated 161 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (17)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
Verify it is up:
bash curl http://localhost:8000/Indonesia Stock Tickers
Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'
High
- Category
- Supply Chain
- Confidence
- 70% confidence
- Finding
Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Keep alive with systemd
bash sudo nano /etc/systemd/system/yfinance.serviceini
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Keep alive with systemd
bash sudo nano /etc/systemd/system/yfinance.serviceini
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Keep alive with systemd
bash sudo nano /etc/systemd/system/yfinance.serviceini
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Keep alive with systemd
bash sudo nano /etc/systemd/system/yfinance.serviceini
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
text ```bash sudo systemctl enable yfinance sudo systemctl start yfinance sudo systemctl status yfinance
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill instructs the agent to start a long-running FastAPI/uvicorn server in the background to fulfill a simple data-fetching task. That expands the execution scope from one-shot retrieval into persistent local service management, increasing attack surface and enabling unintended exposure or abuse of a localhost HTTP service.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The rule states that if a request is in Bahasa Indonesia, the skill must respond in Bahasa. This is a locale/language behavior expressed as a hard requirement, and the file does not indicate that the user may choose another response language or opt in to this constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The module docstring says the connector is 'optimised for Indonesia stocks' and later code auto-appends the .JK suffix by default, which biases behavior toward a specific market/locale. For a general finance connector, this is a locale-specific constraint that is not presented as an explicit user choice in the top-level description.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This manifest file states that all tickers without a suffix are automatically treated as IDX stocks by appending .JK, which is a broad default behavior without clear exclusion cases. Because many stock symbols exist across markets, the description does not clearly define when auto-conversion should or should not occur, increasing the chance of unintended interpretation.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The dependency is specified with a lower bound only, which allows future installs to resolve to different FastAPI versions over time. This weakens build reproducibility and can unintentionally introduce vulnerable or breaking releases into the skill's runtime environment.
- Content
text fastapi>=0.110.0 uvicorn[standard]>=0.29.0 yfinance>=0.2.40 pandas>=2.0.0
Unverifiable Dependency: fastapi has 3 known advisory(ies) (CVE-2021-32677 (Cross-Site Request Forgery (CSRF) in FastAPI); CVE-2021-32677 (FastAPI is a web framework for building APIs with Python 3.6+ based on standard ); CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
FastAPI has known advisories, and because the manifest does not pin a specific version, it is impossible to verify whether the deployed version is affected. In practice this creates avoidable exposure because installers may resolve to a vulnerable release depending on timing and environment.
- Content
Unverifiable Dependency: uvicorn has 4 known advisory(ies) (CVE-2020-7694 (Log injection in uvicorn); CVE-2020-7695 (HTTP response splitting in uvicorn); CVE-2020-7694 (This affects all versions of package uvicorn. The request logger provided by the) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
Uvicorn has multiple historical advisories, but the open-ended requirement prevents determining whether the installed version contains fixes. This uncertainty is a supply-chain security weakness because server-facing packages can become exposed through vulnerable transitive or resolved versions.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
Using yfinance>=0.2.40 without an upper bound or exact pin means deployments may consume newer releases that have not been tested or reviewed. This creates supply-chain and stability risk because behavior and security posture can change between installs.
- Content
text fastapi>=0.110.0 uvicorn[standard]>=0.29.0 yfinance>=0.2.40 pandas>=2.0.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
An unpinned pandas requirement permits non-deterministic installs and may pull in versions with newly introduced flaws or incompatible behavior. For a data-processing skill, this can affect both reliability and the security reviewability of the deployed environment.
- Content
text fastapi>=0.110.0 uvicorn[standard]>=0.29.0 yfinance>=0.2.40 pandas>=2.0.0
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 79% confidence
- Finding
Because pandas is not pinned, the project cannot demonstrate that it avoids versions associated with known advisories. Even if the current minimum is above some affected releases, the absence of exact version control leaves room for inconsistent and unverified installations.
- Content