TickFlow Data

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:49 AM UTC
• Version: 1.0.2

Overview

This skill appears to be a legitimate TickFlow market-data helper, but its setup instructions use risky install and secret-storage patterns that users should review before installing.

Review the install steps before using this skill. Prefer installing uv through a trusted package manager or verified release, avoid pipe-to-shell commands, pin and lock dependencies where possible, and store TICKFLOW_API_KEY in a password manager, OS keychain, or a local uncommitted env file rather than a shell startup file.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:26

Finding

Unverified Remote Installation Scripts Executed Directly by Shells

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26-29
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash

curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows (PowerShell)
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

Technical Analysis

The installation instructions download scripts from an external URL and immediately execute the received content using sh or PowerShell's Invoke-Expression. The downloaded payload is not pinned to a specific immutable version and is not verified using a cryptographic checksum or signature before execution.

The PowerShell command additionally uses -ExecutionPolicy ByPass, disabling a local protection intended to restrict script execution. Although the URL is presented as the official installation source for uv, direct execution still creates a mutable supply-chain code-execution channel. A compromise of the hosting service, domain, DNS resolution, TLS delivery path, or publisher account could change the effective payload after this Skill has been reviewed.

Installing uv is relevant to the documented workflow, but executing an unverified remote response and bypassing execution policy are not necessary minimum-privilege methods of installation.

Attack Path

1. A user or Agent follows the installation instructions in SKILL.md.
2. The system requests install.sh or install.ps1 from the external server.
3. An attacker compromises or otherwise controls the remote delivery path or hosted script.
4. The malicious response is passed directly to sh or iex without local inspection or integrity verification.
5. The payload executes with all permissions available to the invoking user.
6. The payload can access local data, modify user configuration, steal credentials, install additional software, or establish persistence.

Impact Assessment

Successful exploitatio ...[truncated 530 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all direct curl | sh and irm | iex installation commands.
• Do not bypass the PowerShell execution policy.
• Prefer a trusted operating-system package manager with a version-pinned package.
• If a standalone installer is required, download a specific immutable release artifact separately.
• Verify the artifact against a publisher-provided cryptographic signature or pinned SHA-256 checksum before execution.
• Display or inspect the downloaded script before running it rather than piping the network response directly into an interpreter.
• Execute installation with an unprivileged account and avoid sudo, administrator shells, or other unnecessary elevation.
• Document the exact expected release version and trusted distribution source so the installation process remains reproducible.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Mutable and Overly Broad Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43-49
Vulnerability Type: Insecure dependency and supply-chain configuration
Risk Level: Medium

toml

dependencies = [
    "tickflow[all]>=0.1.17",
]
EOF

# Use uv to synchronize dependencies
uv sync

Technical Analysis

The generated project configuration specifies only a lower version bound for tickflow and enables its broad all extra. It then directs the user to resolve and install the package through uv sync.

The constraint >=0.1.17 allows future package releases to be selected without further review. The all extra increases the number of transitive dependencies and therefore expands the supply-chain attack surface beyond dependencies that may be strictly required for basic market-data access. The Skill does not provide a committed lockfile, exact version pins, package hashes, an explicit trusted package index, or evidence that the complete dependency graph has been reviewed.

This does not prove that the named package is malicious. The vulnerability is that installation results are mutable after audit and depend on future package and transitive-dependency state.

Attack Path

1. A user creates the documented pyproject.toml and runs uv sync.
2. The resolver contacts a configured package index and selects a version satisfying tickflow[all]>=0.1.17.
3. A compromised future release or malicious transitive dependency is included in the resolved dependency graph.
4. The package is downloaded and installed because no reviewed lockfile or artifact hash prevents substitution.
5. Malicious package code executes during installation, import, or normal SDK use.
6. When imported by a script, the package may access the TickFlow API key, local files, process environment, and network resources available to the user.

Impact Assessment

Exploitation could lead to arbitrary code execution with the permissions of the user run ...[truncated 507 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the SDK to an exact version that has been reviewed, rather than using an open-ended lower bound.
• Generate, review, and commit a uv.lock file so subsequent installations resolve to the same dependency graph.
• Use cryptographic package hashes or artifact signature verification where supported.
• Replace the all extra with only the specific optional features required by the documented use cases.
• Configure an explicit trusted package index and disable unintended fallback indexes where practical.
• Review both direct and transitive dependencies for unexpected install hooks, network activity, and package-name confusion.
• Run dependency installation and SDK scripts as an unprivileged user in an isolated virtual environment or container.
• Establish a controlled update process that reviews and regenerates the lockfile before adopting newer package versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

Using a command chain such as 'curl ... | sh' removes the opportunity to inspect the downloaded content before execution and turns a documentation step into immediate arbitrary code execution from a remote source. In a skill context, users are likely to copy-paste commands verbatim, which increases the chance of compromise if the script source is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

bash

# macOS/Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows (PowerShell)
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

bash

# 创建 python 工作目录
mkdir -p python
cd python

# 创建 pyproject.toml 文件

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly tells users to append the API key to a shell startup file, which causes the credential to be stored in plaintext on disk and potentially exposed through backups, dotfile sync, screenshots, shared home directories, or accidental publication. While this is common operational guidance, presenting it without any warning or safer alternatives normalizes insecure secret handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The natural-language content of the skill, including its description and all usage instructions, forces a specific language/locale experience. There is no indication that the skill is region-specific by policy or that users may choose another language, which can violate language-choice expectations.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The skill instructs users to fetch and execute a remote installation script directly from the network. This creates a supply-chain and man-in-the-middle risk surface: if the remote host, distribution channel, or fetched script is compromised, arbitrary code will run immediately on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

bash

# macOS/Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows (PowerShell)
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

Static analysis

No suspicious patterns detected.