T08 · Insecure Dependencies
Warning
- Location
SKILL.md:142- Finding
Unpinned and Unauditable Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Finance Toolkit Free
Security checks for vulnerabilities and agentic risk
Overview
This is a finance quote and watchlist helper with some overbroad wording and dependency hygiene issues, but the inspected artifact does not show hidden, destructive, or deceptive behavior.
Install only in a virtual environment or other restricted workspace, review and pin dependencies before running pip, and treat watchlist tickers or portfolio-like data as potentially visible to the agent and external quote APIs during lookups. The skill appears purpose-aligned, but its trigger text and privacy language should be tightened.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation guidance is broad enough to match generic data analysis, reporting, statistics, and visualization tasks beyond simple finance quote retrieval. In an agent environment, overly broad triggers can cause the wrong skill to be invoked for unrelated requests, unnecessarily granting read/write/exec-capable tooling access to user data and workflows.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest description limits the skill to market quotes, historical series retrieval, caching, and local watchlist management for personal investors. However, the documentation for core execution says it supports '创建/查询/导出操作', which expands the skill into broader data generation/export behavior not clearly tied to the stated finance-tracking scope.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The huge keyword list defines capability scope so broadly that it weakens trigger boundaries and encourages invocation on loosely related prompts. In the context of a skill exposing 'read', 'write', and 'exec', ambiguous routing increases the chance of unnecessary code execution or data exposure during benign user requests.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The claim that watchlist data 'will not be uploaded to any server' overstates privacy guarantees that the documented execution model cannot fully support. Because the skill runs in agent/automation contexts and depends on networked components, users may disclose portfolio or watchlist data under a false assumption of local-only handling, creating a privacy and trust risk.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest description states both that the tool supports '实时报价' and that it is '不适用于实时流数据处理'. These are not identical concepts, but together they create an intent mismatch about whether the tool is real-time or delayed/non-streaming, especially for agents deciding when to use it.
- Content