Back to skill

Security audit

Mysteel_PriceSearch

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Mysteel market-data client, but it needs Review because CSV mode can delete unrelated CSV files in a user-selected folder and credential handling is under-scoped.

Install only if you are comfortable sending query text to Mysteel's remote API and managing a Mysteel token. Avoid using --output-dir with shared or important folders, because CSV mode may delete existing .csv files there; prefer the default skill output directory and keep backups of valuable exports. Store the API token carefully and do not commit or share references/api_key.md after adding a real key.

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/search.py:49
Finding

Automatic cleanup can delete unrelated CSV files from an arbitrary output directory

Content
View full analysis
int: """ Delete CSV files older than specified age. Returns the number of files deleted. """ if not output_dir.exists(): return 0 deleted_count = 0 cutoff_time = datetime.now() - timedelta(hours=max_age_hours) for file in output_dir.glob("*.csv"): try: mtime = datetime.fromtimestamp(file.stat().st_mtime) if mtime < cutoff_time: file.unlink() deleted_count += 1 except Exception: # Skip files that can't be accessed pass return deleted_count def cleanup_excess_files(output_dir: Path, max_files: int = 100) -> int: """ Delete oldest CSV files when file count exceeds limit. Returns the number of files deleted. """ if not output_dir.exists(): return 0 # Get all CSV files with their modification times files = [] for file in output_dir.glob("*.csv"): try: files.append((file, file.stat().st_mtime)) except Exception: pass # Sort by modification time (newest first) files.sort(key=lambda x: x[1], reverse=True) # Delete files exceeding the limit deleted_count = 0 if len(files) > max_files: for file, _ in files[max_files:]: try: file.unlink() deleted_count += 1 except Exception: # Continue on error pass return deleted_count ``` The cleanup is enabled automatically when saving results: ```python # Create output directory if it doesn't exist output_dir.mkdir(parents=True, exist_ok=True) ...[truncated 3010 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/search.py:24
Finding

API token is expected to be stored in a plaintext file inside the project tree

Content
View full analysis
str | None: """ Load API key from file. Returns the API key if found and valid, None otherwise. """ if API_KEY_FILE.exists(): content = API_KEY_FILE.read_text(encoding="utf-8") lines = content.strip().splitlines() if len(lines) >= 1 and lines[0] and not lines[0].startswith("YOUR_API_KEY"): return lines[0].strip() return None ``` The error message directs users to place the credential in that project file: ```python # Load API key from file api_key = load_api_key() if not api_key: print("Error: API key is required. Save it in references/api_key.md", file=sys.stderr) sys.exit(1) ``` ### Technical Analysis The application expects a live API token to be stored as the first line of `references/api_key.md`, which is part of the Skill directory. This is a plaintext credential-storage pattern without access-control validation, encryption, secret-store integration, or protection against accidental source-control inclusion. The audited `references/api_key.md` file is currently empty, so no active credential was exposed in the reviewed artifact. The vulnerability concerns the prescribed runtime configuration: once a user follows the error message, a secret will be placed directly inside a project tree that may be committed, packaged, archived, backed up, or shared. The token is sent only to the documented HTTPS endpoint at `https://mcp.mysteel.com/mcp/info/ai-search/search`. That network transmissi ...[truncated 1181 chars]
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares Python dependencies and documents behaviors that imply network access plus file read/write, but it does not declare any explicit tool scope or permissions boundary. This weakens least-privilege enforcement and can let the skill operate with broader capabilities than reviewers or orchestrators expect, increasing the chance of unintended file access, data exfiltration, or unsafe external requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger description is very broad, covering many kinds of financial, macroeconomic, industrial-chain, and even settlement-document scenarios without clear exclusion criteria. Overbroad activation can cause the agent to invoke this skill in unintended contexts, sending sensitive user prompts or business data to the skill and potentially to external services when a simpler or safer path should have been used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file documents a POST request to a remote endpoint and includes both a user-provided query field and a token-based authentication header, which can affect user privacy and credential security. The document provides no warning that query contents are sent off-system or that the token is sensitive and should be protected.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_reference.md (reported line 69)May include surrounding context.

  • 债券收益率
  • 外汇汇率

cURL Example

bash
curl --location 'https://mcp.mysteel.com/mcp/info/ai-search/search' \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

When CSV mode is used, the script automatically deletes old or excess .csv files in the chosen output directory without a clear confirmation step at invocation time. If a user points --output-dir at an unexpected or shared directory, this can cause unintended data loss of legitimate CSV files, even though the deletion is limited to .csv files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script sends user query text and the API token to a remote third-party endpoint, but there is no explicit disclosure or consent at the point of use. In this skill context, user queries may contain sensitive business, pricing, or trading information, so silent transmission increases confidentiality and compliance risk if users assume processing is local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

L158-L159 的“回复格式”仅要求详细标明指标,但该技能整体说明和使用方式均固定为中文,未见允许按用户偏好切换语言的说明。根据策略,若技能强制单一语言而无用户选择或明确合理性说明,应视为自然语言策略问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The request schema and examples specify a fixed Chinese value for the source field and use Chinese-only query examples, which can imply a language-specific requirement. The file does not clarify whether other languages are supported or whether this locale constraint is intentional and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.