Security audit

iFinD投研-自然语言查询金融数据

Security checks for vulnerabilities and agentic risk

Overview

This finance-data skill matches its stated purpose overall, but it needs review because it stores an API token locally and can be configured to send that token to an arbitrary URL.

Install only if you trust the publisher and the iFind Repilot endpoint. Avoid using --set-url unless you fully control and trust the destination, rotate any token that may have been used with an untrusted URL, and treat ~/.config/ifind-repilot/config.json and shell history as sensitive because they may contain the token.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_data.py:159
Finding: Authentication Token Can Be Redirected to an Arbitrary Network Host
Content: View full analysis
", file=sys.stderr) sys.exit(1) set_config("base_url", sys.argv[2]) sys.exit(0) ``` ### Technical Analysis The Skill's declared functionality requires requests to the fixed finance service at `https://repilot.51ifind.com/`. However, the undocumented `--set-url` option accepts an arbitrary URL and persists it as `base_url` without validating the scheme, hostname, port, or destination. Every subsequent finance query retrieves that configurable URL and attaches the stored authentication token to the `Authorization` header. The natural-language finance query is also transmitted to the selected host as a URL query parameter. This exceeds the minimum network privileges needed for the declared functionality. An arbitrary endpoint is not necessary when the Skill is intended to communicate with one defined service. The lack of HTTPS enforcement also permits configuration of a plaintext ...[truncated 1324 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_data.py:119
Finding: Authentication Token Is Exposed Through Command-Line Arguments and Plaintext Configuration
Content: View full analysis
/scripts/fetch_data.py --set-token ``` The script accepts the credential from `sys.argv`: ```python if sys.argv[1] == "--set-token": if len(sys.argv) < 3: print("错误: 请提供 token 值", file=sys.stderr) print("用法: python fetch_data.py --set-token ", file=sys.stderr) sys.exit(1) set_config("auth_token", sys.argv[2]) sys.exit(0) ``` It then stores the token as plaintext without explicitly setting restrictive file permissions: ```python def set_config(key: str, value: str): """设置配置项""" CONFIG_DIR.mkdir(parents=True, exist_ok=True) config = get_config() config[key] = value with open(CONFIG_FILE, "w") as f: json.dump(config, f, indent=2) print(f"已保存到 {CONFIG_FILE}") return True ``` ### Technical Analysis Supplying a secret through a command-line argument can expose it through shell history, process-inspection facilities, diagnostic collection, audit logs, or command telemetry. The precise visibility of process arguments depends on the operating system and its access controls, but command history commonly persists after setup completes. The token is subsequently stored in plaintext at `~/.config/ifind-repilot/config.json`. Plaintext local storage is not inherently avoidable for every command-line client, but the script does not explicitly enforce a `0700` mode on the configuration directory or a `0600` mode on the credential file. The resulting permissions therefore depend on the user's umask and any pre-existing directory or file permissions. The `--check-token` operation only tests whether the token exists and does n ...[truncated 1632 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill invokes a Python script that both writes a persistent token to the user's home directory and makes outbound network requests, yet the manifest declares no explicit tool scope or permissions. This creates an authorization transparency gap: an agent or reviewer cannot easily see that using the skill will persist secrets locally and contact an external service, increasing the risk of unintended secret handling or overbroad execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill description is written to activate for natural-language financial queries and the examples/instructions consistently assume Chinese queries only. There is no stated user opt-in or alternative locale/language support, which can violate language/locale policy when a skill implicitly forces one language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The command usage and all sample queries are exclusively in Chinese, and the execution rules instruct generating a natural-language query without noting any language options. This creates an implicit locale restriction without user choice or a documented policy justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The user-facing title, description, and usage examples are entirely in Chinese, which signals the skill is intended to operate in a fixed language without any documented opt-in or alternative locale support. This matches the policy category for language or locale constraints that are imposed without user choice.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The --set-url option lets a user redirect requests to any arbitrary endpoint while the script still attaches the configured Authorization token. That turns a finance-data client into a generic authenticated HTTP caller and can leak the bearer token to attacker-controlled infrastructure if a malicious skill invocation or social engineering convinces the user to set a hostile base URL.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest frames the skill as a natural-language financial data query tool. In addition to querying data, the code writes configuration to ~/.config/ifind-repilot/config.json, including auth tokens and base URL settings, which is broader behavior than the manifest itself communicates.
Content: No source excerpt is available for this finding.