Financial Audit Domain

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:21 AM UTC
• Version: 1.0.0

Overview

This skill is finance-analysis oriented, but it asks agents to auto-install an unpinned dependency and ships executable scripts that fetch data and write reports without sufficient scoping or input hardening.

Install only if you trust both this publisher and the exact universal-task-os dependency source. Use it in a constrained workspace, provide only normal six-digit stock codes and trusted JSON inputs, review generated HTML before sharing/opening broadly, and prefer a version that pins dependencies, asks before installing other skills, validates filenames, confines outputs to a dedicated directory, and escapes HTML content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30

Finding

Automatic Installation and Loading of an Unpinned External Skill

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/download_statements.py:294

Finding

Path Traversal and Arbitrary File Overwrite Through Unsanitized Output Names

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_report.py:607

Finding

Stored HTML Injection in Generated Financial Reports

Content

View full analysis

') w(f'

财报排雷分析报告

') w(f'

股票代码：{results["stock_code"]} | 分析期间：{periods[0]} ~ {periods[-1]} | 合并报表口径 | {datetime.now().strftime("%Y-%m-%d %H:%M")}

') w(f'') w(f'

') ``` Warnings are inserted without escaping: ```python if results["data_quality"]["warnings"]: w(f'

') w(f'⚠️ 数据质量警告
') for dq in results["data_quality"]["warnings"]: w(f'{dq}
') w(f'

') ``` Anomaly names and details are passed to a helper that performs direct interpolation: ```python def anomaly_item_html(name, detail, is_critical=False): """生成异常列表项HTML""" icon = "🚫" if is_critical else "⚠" cls = "anomaly-item anomaly-critical" if is_critical else "anomaly-item" return f'

{icon}{name}：{detail}

' ``` ```python for a in anoms: w(anomaly_item_html(a["name"], a["detail"])) ``` The HTML title also contains unescaped JSON values: ```python html = f""" 财报排雷报告 — {results['stock_code']} {results.get('company_name', '')} {css_content}

{body}

""" ``` ### Technical Analysis `generate_report.py` accepts a user-selected JSON file and builds HTML through formatted-string concatenation. Dynamic values are not encoded for their HTML context. Potentially attacker-controlled values include: - `stock_cod ...[truncated 2074 chars]

Remediation

View remediation

' f'{icon}' f'{safe_name}' f': {safe_detail}' f'' ) ``` 3. Prefer an auto-escaping template engine such as Jinja2 rather than assembling HTML with formatted strings. 4. Validate the indicator JSON against a strict schema and reject unexpected object or string types. 5. Keep trusted HTML fragments separate from untrusted text. Do not mark untrusted values as safe template content. 6. Add a restrictive Content Security Policy, for example by disabling scripts and restricting network destinations if reports do not require active content. 7. Add tests using payloads in every rendered string field, including element injection, attribute injection, event handlers, and closing-tag sequences. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

There is a significant mismatch between the declared purpose of a finance audit knowledge base and the detected behavior of data merging and local JSON modification. This is dangerous because users may invoke the skill expecting passive reference guidance while it instead performs undeclared data-processing actions, which can alter local artifacts and conceal its real operational scope.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/run_minesweeper.py (reported line 29)May include surrounding context.

python

if os.path.exists(_VENV_PYTHON) and not sys.executable.lower().startswith(_VENV_PYTHON.lower()):
    # 当前不在 minesweeper venv 中，自动 rerun
    os.execv(_VENV_PYTHON, [_VENV_PYTHON] + sys.argv)

# 强制UTF-8输出（Windows GBK兼容）
if sys.stdout.encoding != 'utf-8':

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill declares itself as a reference library but appears to rely on capabilities consistent with file read/write and shell-like behavior without explicitly scoping or constraining those tools. Missing tool permissions make it harder for users and the platform to understand what the skill may access or modify, increasing the risk of unintended file changes or command execution through hidden dependency flows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger phrases are broad enough to match common financial-analysis requests outside the narrow intended scope of A-share non-financial listed companies. Overbroad activation increases the chance that the skill is invoked in inappropriate contexts, which is more dangerous here because the skill also describes dependency loading and possible operational behavior rather than purely passive reference output.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document claims the skill is only a non-executing reference library, but later instructs installation/loading of another skill and operational execution through UTOS. This contradiction is dangerous because it obscures the effective trust boundary: activating an apparently passive knowledge skill may trigger a broader execution framework with additional privileges and behaviors.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill describes automatic installation of a dependency without a clear user-facing warning or consent step. Silent dependency installation is dangerous because it can expand capabilities, introduce new trust assumptions, and surprise users who believed they were only using a static reference library.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Automatic installation of another skill is an unnecessary and risky capability for a domain reference library. It creates a supply-chain and privilege-expansion path where a benign-looking skill can introduce external code or behaviors without explicit approval, potentially leading to unexpected execution or broader system access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The title and the entire requirements file are written as prescriptive instructions in Chinese, with no indication that another language may be used or that the user can opt into this locale. Under the policy rule, forcing a specific language without user choice is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire skill reference is written in Chinese and provides no indication that users may choose another language or that the language restriction is required by a region-specific compliance context. Under the policy, a skill that effectively mandates a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code's natural-language interface and comments indicate the skill is designed to operate only in Chinese, and it explicitly reconfigures output for UTF-8 with Chinese messaging. The file does not offer a user language/locale choice or document a justified region-specific constraint, which conflicts with the policy against forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes the skill as a '知识参考库（领域负载物）' for financial-audit analysis, which suggests a reference or analysis knowledge asset scoped to domain logic. This script goes beyond providing reference knowledge by actively fetching live market/financial data from external services via akshare and then preparing it for downstream use, which is a materially different operational behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest emphasizes a domain reference base for financial statement risk analysis, not a data-export or file-generation tool. This script persists fetched company financial data as a local JSON file, which is an additional behavior not implied by the manifest's description of a knowledge-only domain payload.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The generated HTML hard-codes lang="zh-CN", which imposes a specific language/locale policy on all output. The file does not offer the user a language choice or explain that the tool is intentionally limited to a China-specific/regional workflow.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_minesweeper.py (reported line 44)May include surrounding context.

python

print(f"\n{'='*60}")
    print(f"  {name}")
    print(f"{'='*60}")
    result = subprocess.run(cmd, shell=False, cwd=os.getcwd())
    if result.returncode != 0:
        print(f"\n❌ 步骤失败: {name}")
        sys.exit(1)

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The dependency declaration states that without UTOS the skill only has reference capability and cannot execute any analysis tasks, yet later sections define report generation, output formats, and dynamic topology-driven execution as if these are intrinsic skill operations. While some of this may be intended as UTOS-facing specification, the documentation mixes 'reference-only' and 'operational execution' language in a way that blurs actual intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code explicitly enforces UTF-8 output for Chinese text and all user-facing help, status, and warnings are hard-coded in Chinese. For a general-purpose skill, this constitutes a language/locale constraint without user opt-in or an offered alternative.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Lines L031-L033 explicitly reconfigure stdout to UTF-8, imposing a specific output encoding as a default behavior. Under the policy, forcing a language/locale-related setting without user opt-in can be a natural-language policy concern unless clearly justified as a region-specific requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.