iFinD投研-金融资讯搜索

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:40 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent financial-news search tool, but it handles API tokens in risky ways and can send them to an arbitrary configured endpoint.

Install only if you trust the publisher and are comfortable with a local plaintext API token. Do not paste real tokens into chat or shell commands when avoidable, do not use --set-url unless you fully trust the endpoint, and consider rotating any token previously configured through command-line history.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fetch_data.py:36

Finding

Authentication Token Can Be Sent to an Arbitrary Configurable Endpoint

Content

View full analysis

", file=sys.stderr) sys.exit(1) set_config("base_url", sys.argv[2]) sys.exit(0) ``` ### Technical Analysis The script supports an undocumented `--set-url` option that stores an arbitrary base URL in the shared configuration file. Subsequent requests retrieve that value without validating its scheme, hostname, port, or destination. The stored authentication token is then unconditionally attached to the request through the `Authorization` header. Consequently, the token is not restricted to the declared service at `https://repilot.51ifind.com/`. An attacker-controlled HTTP or HTTPS server can be configured as the endpoint and receive both the token and the user's search query. Allowing unrestricted endpoints exceeds the minimum privileges required for the declared financial-news search functionality. The Skill only needs to communicate with its documented API host. The implementation also does not enforce HTTPS, so a configured plain-HTTP endpoint can expose the token and query to network observers. Redirect behavior is not explicitly constrained or validated. ...[truncated 1839 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:28

Finding

Authentication Token Is Exposed Through Process Arguments and Plaintext Configuration

Content

View full analysis

/scripts/fetch_data.py --set-token ``` The token is stored as plaintext JSON without explicit file-permission enforcement: ```python with open(CONFIG_FILE, "w") as f: json.dump(config, f, indent=2) ``` The command-line argument is passed directly to the configuration writer: ```python if sys.argv[1] == "--set-token": if len(sys.argv) < 3: print("错误: 请提供 token 值", file=sys.stderr) print("用法: python fetch_data.py --set-token ", file=sys.stderr) sys.exit(1) set_config("auth_token", sys.argv[2]) sys.exit(0) ``` ### Technical Analysis Secrets supplied as command-line arguments may be recorded in shell history and can be exposed through process inspection, monitoring software, diagnostic tools, audit logs, or command telemetry. The documented configuration procedure therefore creates avoidable copies of the authentication token outside the Skill's configuration file. The script writes the token in plaintext to `~/.config/ifind-repilot/config.json`. Although plaintext storage may be necessary when an operating-system credential store is unavailable, the implementation does not explicitly apply restrictive permissions to either the configuration directory or file. Effective permissions therefore depend on the user's current umask and on any pre-existing file. Opening an existing configuration with `"w"` truncates it but does not correct permissive permissions already assigned to that file. The script also does not detect or reject symbolic links, which can create additional local file-handling risk in environments where another user can man ...[truncated 1625 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill invokes a Python script that performs outbound network access and writes a token to a local config file, but the manifest does not declare any explicit tool scope or permissions. This weakens least-privilege controls and makes it harder for a host agent or reviewer to understand and constrain what the skill can do before execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description and all operational instructions are written exclusively in Chinese, and the skill instructs the agent to generate natural-language queries in that context without any opt-in or alternative locale handling. This can violate language/locale policy when users or deployments expect language choice rather than a fixed language.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions explicitly tell the agent to ask the user for an authentication token and then use it in a command-line workflow, encouraging sensitive credential handling through chat and shell history. Tokens shared this way may be exposed in conversation logs, agent telemetry, terminal history, or downstream tool outputs, enabling unauthorized API access.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The error-handling guidance reinforces collection of authentication tokens via conversational flow by telling the agent to prompt the user to obtain and send the token after a missing-token error. This normalizes insecure credential transmission and increases the chance of token leakage through logs or agent memory.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script allows base_url to be overridden from a local config file and also exposes a --set-url command, so requests can be redirected to arbitrary endpoints while still attaching the authorization token. In this skill’s context, that broadens a simple news-query tool into a generic authenticated HTTP client and creates a realistic token exfiltration and data disclosure risk if the URL is misconfigured or maliciously changed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script sends the user’s natural-language query and bearer token to a remote service, but it provides no clear user-facing notice at execution time that sensitive input and credentials are being transmitted. In this skill, network transmission is expected, but the danger increases because the destination may be reconfigured, so users may unknowingly disclose queries and tokens to an unintended server.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest presents the skill as a search capability that retrieves relevant financial news fragments. In addition to querying, this script creates a config directory and writes auth_token and base_url values to a persistent local file, which is behavior not reflected in the manifest-level description of the skill's function.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script stores the authentication token in a local JSON config file without warning about on-disk persistence or applying any evident protection measures. This can expose credentials to other local users, backups, shell history workflows, or accidental disclosure, especially on multi-user systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

All user-facing documentation and CLI messages in this file are fixed to Chinese, which can amount to a forced language choice without giving users an alternative locale or opt-in. The policy specifically calls for flagging language or locale constraints when they are imposed without user choice or clear justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.