T09 · Insecure Skill Coding Practices
Warning
- Location
forensics.py:49- Finding
Untrusted Backtest Statistics Embedded Directly into LLM Context
- Content
View full analysis
- Remediation
View remediation
Security audit
Qc Order Forensics
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent local backtest-analysis tool, but its LLM-ready reports can carry untrusted prompt text and its core cash-flow calculations appear materially misleading.
Review before installing. Use this only on trusted backtest exports, treat generated reports as untrusted data when giving them to another LLM, and do not rely on the ROI, cashflow, yearly, or drawdown outputs until the sell-cashflow sign logic is fixed and tested. Prefer installing with pinned, reviewed pandas and numpy versions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This is a real integrity flaw: in roi_breakdown(), both buy and sell orders are assigned negative cash flow, so proceeds from sells are treated as additional losses. That inverts ROI-related outputs and can materially mislead downstream users or LLMs consuming the report into making incorrect trading or risk conclusions.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This is also a true vulnerability affecting report integrity: monthly_cashflow() and yearly_breakdown() label values as net cashflow, but sell transactions are encoded as negative outflows just like buys. As a result, time-series cashflow, cumulative totals, and drawdown-cause analysis can be systematically inverted or distorted, producing false forensic conclusions.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency is specified with a lower bound only, which allows newer, unreviewed versions to be installed over time. This weakens build reproducibility and can silently introduce vulnerable or incompatible releases into the environment.
- Content
text pandas>=1.5.0 numpy>=1.23.0
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 82% confidence
- Finding
Because pandas is not pinned, it is not possible to determine from this manifest whether deployment will include a version affected by known advisories. In a forensic analysis skill, pandas is likely used for structured data processing, so the risk is contextualized by normal data handling rather than obviously dangerous behavior, but uncertainty around vulnerable version selection remains a supply-chain concern.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The numpy requirement is not pinned to a specific version, so installations may resolve to different releases depending on time and environment. This creates supply-chain and patch-management uncertainty, making it harder to verify whether deployed versions are safe.
- Content
text pandas>=1.5.0 numpy>=1.23.0
Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
The manifest does not fix the numpy version, so an installer may choose a release with known security issues or other unsafe behavior, and the manifest alone cannot prove safety. Given this skill processes backtest and order data rather than privileged system functions, the context does not amplify impact, but dependency uncertainty still presents a real supply-chain hygiene weakness.
- Content
Static analysis
No suspicious patterns detected.