TickFlow Data

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:49 AM UTC
• Version: 1.0.2

Overview

This skill appears to be a legitimate TickFlow market-data helper, but its setup instructions use risky install and secret-storage patterns that users should review before installing.

Review the install steps before using this skill. Prefer installing uv through a trusted package manager or verified release, avoid pipe-to-shell commands, pin and lock dependencies where possible, and store TICKFLOW_API_KEY in a password manager, OS keychain, or a local uncommitted env file rather than a shell startup file.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:26
• Finding: Unverified Remote Installation Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 26-29 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```bash curl -LsSf https://astral.sh/uv/install.sh | sh # Windows (PowerShell) powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex" ``` ### Technical Analysis The installation instructions download scripts from an external URL and immediately execute the received content using `sh` or PowerShell's `Invoke-Expression`. The downloaded payload is not pinned to a specific immutable version and is not verified using a cryptographic checksum or signature before execution. The PowerShell command additionally uses `-ExecutionPolicy ByPass`, disabling a local protection intended to restrict script execution. Although the URL is presented as the official installation source for `uv`, direct execution still creates a mutable supply-chain code-execution channel. A compromise of the hosting service, domain, DNS resolution, TLS delivery path, or publisher account could change the effective payload after this Skill has been reviewed. Installing `uv` is relevant to the documented workflow, but executing an unverified remote response and bypassing execution policy are not necessary minimum-privilege methods of installation. ### Attack Path 1. A user or Agent follows the installation instructions in `SKILL.md`. 2. The system requests `install.sh` or `install.ps1` from the external server. 3. An attacker compromises or otherwise controls the remote delivery path or hosted script. 4. The malicious response is passed directly to `sh` or `iex` without local inspection or integrity verification. 5. The payload executes with all permissions available to the invoking user. 6. The payload can access local data, modify user configuration, steal credentials, install additional software, or establish persistence. ### Impact Assessment Successful exploitatio ...[truncated 530 chars]
• Remediation: ## Remediation Suggestions - Remove all direct `curl | sh` and `irm | iex` installation commands. - Do not bypass the PowerShell execution policy. - Prefer a trusted operating-system package manager with a version-pinned package. - If a standalone installer is required, download a specific immutable release artifact separately. - Verify the artifact against a publisher-provided cryptographic signature or pinned SHA-256 checksum before execution. - Display or inspect the downloaded script before running it rather than piping the network response directly into an interpreter. - Execute installation with an unprivileged account and avoid `sudo`, administrator shells, or other unnecessary elevation. - Document the exact expected release version and trusted distribution source so the installation process remains reproducible.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43
• Finding: Mutable and Overly Broad Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 43-49 **Vulnerability Type**: Insecure dependency and supply-chain configuration **Risk Level**: Medium ```toml dependencies = [ "tickflow[all]>=0.1.17", ] EOF # Use uv to synchronize dependencies uv sync ``` ### Technical Analysis The generated project configuration specifies only a lower version bound for `tickflow` and enables its broad `all` extra. It then directs the user to resolve and install the package through `uv sync`. The constraint `>=0.1.17` allows future package releases to be selected without further review. The `all` extra increases the number of transitive dependencies and therefore expands the supply-chain attack surface beyond dependencies that may be strictly required for basic market-data access. The Skill does not provide a committed lockfile, exact version pins, package hashes, an explicit trusted package index, or evidence that the complete dependency graph has been reviewed. This does not prove that the named package is malicious. The vulnerability is that installation results are mutable after audit and depend on future package and transitive-dependency state. ### Attack Path 1. A user creates the documented `pyproject.toml` and runs `uv sync`. 2. The resolver contacts a configured package index and selects a version satisfying `tickflow[all]>=0.1.17`. 3. A compromised future release or malicious transitive dependency is included in the resolved dependency graph. 4. The package is downloaded and installed because no reviewed lockfile or artifact hash prevents substitution. 5. Malicious package code executes during installation, import, or normal SDK use. 6. When imported by a script, the package may access the TickFlow API key, local files, process environment, and network resources available to the user. ### Impact Assessment Exploitation could lead to arbitrary code execution with the permissions of the user run ...[truncated 507 chars]
• Remediation: ## Remediation Suggestions - Pin the SDK to an exact version that has been reviewed, rather than using an open-ended lower bound. - Generate, review, and commit a `uv.lock` file so subsequent installations resolve to the same dependency graph. - Use cryptographic package hashes or artifact signature verification where supported. - Replace the `all` extra with only the specific optional features required by the documented use cases. - Configure an explicit trusted package index and disable unintended fallback indexes where practical. - Review both direct and transitive dependencies for unexpected install hooks, network activity, and package-name confusion. - Run dependency installation and SDK scripts as an unprivileged user in an isolated virtual environment or container. - Establish a controlled update process that reviews and regenerates the lockfile before adopting newer package versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# macOS/Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows (PowerShell)
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

• Confidence: 96% confidence
• Finding: Using a command chain such as 'curl ... | sh' removes the opportunity to inspect the downloaded content before execution and turns a documentation step into immediate arbitrary code execution from a remote source. In a skill context, users are likely to copy-paste commands verbatim, which increases the chance of compromise if the script source is tampered with.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 创建 python 工作目录
mkdir -p python
cd python

# 创建 pyproject.toml 文件

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly tells users to append the API key to a shell startup file, which causes the credential to be stored in plaintext on disk and potentially exposed through backups, dotfile sync, screenshots, shared home directories, or accidental publication. While this is common operational guidance, presenting it without any warning or safer alternatives normalizes insecure secret handling.

Natural-Language Policy Violations

Low

• Confidence: 98% confidence
• Finding: The natural-language content of the skill, including its description and all usage instructions, forces a specific language/locale experience. There is no indication that the skill is region-specific by policy or that users may choose another language, which can violate language-choice expectations.

External Script Fetching

Low

• Category: Supply Chain

Content

```bash
# macOS/Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows (PowerShell)
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

• Confidence: 93% confidence
• Finding: The skill instructs users to fetch and execute a remote installation script directly from the network. This creates a supply-chain and man-in-the-middle risk surface: if the remote host, distribution channel, or fetched script is compromised, arbitrary code will run immediately on the user's machine.

Static analysis

No suspicious patterns detected.