Qc Deep Feature Forensics

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:35 AM UTC
• Version: 1.0.0

Overview

The skill appears to do the advertised trade-analysis work, with disclosed local outputs and market-data downloads, but users should treat generated CSVs carefully if the input file is untrusted.

Install and run this in a virtual environment, preferably with pinned dependencies. Use it on orders CSVs you trust, and be cautious opening the generated *_features.csv in Excel or similar spreadsheet tools because untrusted symbols or text could be interpreted as formulas. Expect it to create feature_diagnosis.md, a feature CSV, and yfinance_cache next to the input file.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: deep_forensics.py:351

Finding

Spreadsheet Formula Injection in Generated Feature CSV

Content

View full analysis

_features.csv` file in Excel or another formula-capable spreadsheet application. The malicious row must satisfy the program's trade-reconstruction requirements, such as having filled buy and sell records, to reach the generated feature matrix. Exact formula behavior depends on the spreadsheet application, its version, and its security configuration. ### Attack Path 1. An attacker creates or modifies an orders CSV accepted by the Skill. 2. The attacker places a formula-prefixed value in the `symbol` column, such as a formula that references an external resource. 3. The attacker supplies corresponding filled buy and sell records so that the value is included in a reconstructed closed tra ...[truncated 984 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Mutable Third-Party Dependency Resolution

Content

View full analysis

=1.5.0 numpy>=1.23.0 yfinance>=0.2.30 ``` `SKILL.md`: ```bash pip3 install pandas numpy yfinance ``` ### Technical Analysis The requirements file specifies only minimum versions. It does not constrain installations to reviewed releases or verify package artifacts using cryptographic hashes. The documented installation command is even less restrictive because it does not use the requirements file. As a result, two installations performed at different times can resolve to different direct and transitive package versions. Newly released versions are trusted automatically without project-specific review. This increases exposure to upstream package compromise, malicious release publication, unexpected dependency changes, and incompatible behavior. The listed package names appear legitimate and no typosquatted or intentionally malicious dependency was identified. Therefore, this is a supply-chain hardening deficiency rather than evidence that the project currently installs a known malicious package. ### Attack Path 1. A user follows the documented command or installs from the lower-bound requirements file. 2. Package resolution selects the latest versions satisfying the unconstrained specifications. 3. If a selected direct or transitive release has been compromised, pip downloads and installs that artifact. 4. Package installation hooks or imported runtime code execute with the permissions of the user running the Skill. 5. Compromised dependency code could access data and resources available to that account, including the supplied trading records and network connectivity. This path depends on a malicious or compromised upstream release; the repository itself does not prov ...[truncated 527 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill writes output files and a local cache (<name>_features.csv, feature_diagnosis.md, yfinance_cache/) but does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch is a real security issue because an agent may be granted broader filesystem write capability than users expect, increasing the chance of unintended overwrites or writes outside the intended workspace if execution wrappers are weak.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The code saves a derived feature matrix to disk via df_feat.to_csv(...). Although there is a later print confirming the saved path, there is no warning or explanatory comment before performing the write, and this output contains transformed data derived from the user's trade records.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script unconditionally creates feature_diagnosis.md in the same directory as the input CSV. While it prints the destination after writing, there is no prior warning, confirmation, or inline documentation at the write site that the skill will create a report file on disk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with a lower bound only, so builds may resolve to different versions over time. That weakens reproducibility and can allow introduction of vulnerable or incompatible upstream releases through normal dependency resolution or supply-chain compromise.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

pandas>=1.5.0
numpy>=1.23.0
yfinance>=0.2.30

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The numpy requirement is unpinned and permits any future version above the minimum. This creates a supply-chain and reproducibility risk because dependency resolution may pull in unexpected releases, including ones with security regressions or breaking behavior.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

pandas>=1.5.0
numpy>=1.23.0
yfinance>=0.2.30

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The yfinance dependency is not pinned to a specific version, so installations are not deterministic. That increases exposure to malicious or vulnerable upstream releases and makes it harder to verify which code is actually being deployed.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

pandas>=1.5.0
numpy>=1.23.0
yfinance>=0.2.30

Static analysis

No suspicious patterns detected.