Security audit

US Stock Financial Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local financial-report generator with a real Markdown-sanitization weakness but no hidden access, persistence, credential use, or destructive behavior.

Reasonable to install for local stock screening, but use trusted financial datasets and be careful before publishing or importing Markdown reports into collaboration tools. Treat the Feishu/Lark section as guidance only; it does not safely automate document permissions.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/analyze_financials.py:128
Finding: Untrusted Financial Data Is Rendered as Unescaped Markdown
Content: View full analysis
= 3] if high_risk: lines.append(f"\n## ⚠️ High-Risk Stocks ({len(high_risk)} with ≥3 red flags)\n") for r in high_risk[:20]: lines.append(f"- **{r['ticker']}** ({r['name']}): " + "; ".join(r["red_flags"])) return "\n".join(lines) ``` ### Technical Analysis The `sector`, `ticker`, and `name` values originate directly from user-supplied CSV or JSON records. They are interpolated into Markdown tables and list entries without escaping Markdown metacharacters, HTML, table delimiters, or line breaks. An attacker controlling an input dataset can supply values containing: - Pipe characters and newlines that alter table structure. - Markdown links ...[truncated 1996 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code substantially matches the financial analysis portions of the description: it reads CSV/JSON stock data, scores PE/PB/ROE/debt-to-equity/revenue growth/net margin/current ratio/dividend yield, detects several red flags, ranks stocks, filters for S&P 500/NASDAQ via an index field, and computes sector rankings. However, the declared purpose also claims a capability to configure Feishu/Lark document permissions for financial reports. There is no code for any network/API access, document handling, authentication, or permission management. This is a clear declared-description mismatch for that capability.
Content: No source excerpt is available for this finding.