Security audit

CN Financial Deep Analysis

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed A-share financial analysis/reporting helper with optional local chart and Word export tools; the main risks are dependency hygiene and financial-output caution, not malicious behavior.

Install the optional Python/MCP pieces only if you need charts, Word output, or live A-share data. Use a virtual environment, review the external cn-financial-mcp repository before installing it, and prefer pinned/current patched dependency versions. Treat generated investment recommendations as research assistance only and verify them with official filings or a qualified professional.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill instructs the agent to read local files such as report inputs, JSON analysis results, chart directories, and local MCP configuration, yet it declares no permissions. Undeclared file-read capability is risky because it can lead to the host granting broader filesystem access than users expect, and the skill also references path-based commands that may encourage reading arbitrary local content.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger phrases include broad, everyday requests like '这个股票怎么样' and '帮我看看这家公司', which can cause the skill to activate in loosely related conversations. Over-broad invocation increases the chance the agent will pull financial data, read local references, or produce investment-style outputs when the user did not intend to invoke this high-context workflow.

Unpinned Dependencies

Low

Category: Supply Chain
Content: matplotlib>=3.7.0 python-docx>=0.8.11 Pillow>=9.0.0
Confidence: 95% confidence
Finding: The dependency is specified with a lower-bound only (matplotlib>=3.7.0), which allows installation of any future version and makes builds non-reproducible. This can introduce supply-chain risk, unexpected breaking changes, or accidental uptake of a later vulnerable release depending on when the environment is built.

Unpinned Dependencies

Low

Category: Supply Chain
Content: matplotlib>=3.7.0 python-docx>=0.8.11 Pillow>=9.0.0
Confidence: 95% confidence
Finding: The dependency is specified as python-docx>=0.8.11 without an upper bound or exact pin, so installs are not deterministic and may pull in unreviewed future versions. In security-sensitive workflows, that increases supply-chain exposure and can cause silent introduction of vulnerable or incompatible releases.

Unpinned Dependencies

Low

Category: Supply Chain
Content: matplotlib>=3.7.0 python-docx>=0.8.11 Pillow>=9.0.0
Confidence: 98% confidence
Finding: Using Pillow>=9.0.0 leaves dependency resolution open to a wide range of versions, including known-bad releases if another resolver or environment constraint selects them. Because Pillow processes image data and has a history of parser vulnerabilities, unpinned use is more dangerous than a purely utility library in this skill context.

Known Vulnerable Dependency: Pillow==9.0.0 — 10 advisory(ies): CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2024-28219 (Pillow buffer overflow vulnerability); CVE-2023-44271 (Pillow Denial of Service vulnerability) +7 more

Critical

Category: Supply Chain
Confidence: 91% confidence
Finding: The file permits Pillow 9.0.0 via the specifier >=9.0.0, and that version is associated with multiple published advisories including code execution, buffer overflow, and denial-of-service issues. Since this skill appears to generate reports and may handle user-provided images or embedded document media through Pillow/python-docx workflows, exploitation could occur through crafted files and lead to service compromise or disruption.

Static analysis

No suspicious patterns detected.