T01 · Skill Instruction Hijacking
Warning
- Location
templates/template_futures_v7_v7.0_locked.py:253- Finding
Unconditional Promotional Content Injection into Generated Financial Reports
- Content
View full analysis
- Remediation
View remediation
Security audit
Ai Xifu Caopan Public
Security checks for vulnerabilities and agentic risk
Overview
This finance-report skill is not clearly malicious, but it needs review because it can expose environment secrets to another skill and write files using unsafe or stale financial-report inputs.
Install only after reviewing and fixing the full-environment subprocess calls, filename containment, automatic write behavior, and stale financial defaults. Treat any generated trading plan as unverified education material, not advice, and avoid running it where valuable environment secrets are available.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T08 · Insecure Dependencies
Error
- Location
global_market/data_adapter.py:60- Finding
Complete Parent Environment Exposed to an Externally Mutable Skill Script
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
templates/template_futures_v7_v7.0_locked.py:451- Finding
Path Traversal Through Unsanitized Report and Cache Filenames
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
templates/template_futures_v7_v7.0_locked.py:180- Finding
Hardcoded Stale Market Recommendations Used as Production Defaults
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (50)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. 切勿将 API 密钥硬编码到代码中 2. 切勿将 API 密钥提交到公共仓库 3. 优先使用环境变量或 .env 文件管理密钥 4. 如发现密钥泄露，请立即在对应平台轮换密钥 ---
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
The code forwards the entire parent environment to a child Python process executing a script from a home-directory skill path. If secrets such as API keys, tokens, proxy settings, or Python-related environment variables are present, the child script can read and exfiltrate them, and the risk is elevated because the executed script is outside this file and may be modified independently.
- Content
python result = subprocess.run( ["python3", script, "single_hq", "--code", symbol, "--set_code", str(set_code)], capture_output=True, text=True, timeout=20, env={**os.environ} ) return result.stdout except Exception as e:
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
This historical-data subprocess repeats the same unsafe pattern of inheriting the full environment for an external script under the user's home directory. In an agent-skill context, this is particularly dangerous because skills often run with access to platform credentials and workspace secrets that an invoked helper script could capture without visibility in this file.
- Content
python result = subprocess.run( ["python3", script, "past_hq", "--code", symbol, "--set_code", str(set_code), "--want_nums", str(days)], capture_output=True, text=True, timeout=20, env={**os.environ} ) return result.stdout except Exception as e:
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Lines L024-L025 state that the skill will not automatically modify any reasoning-model files or configuration and only the author may manually modify configuration. Later, L242-L251 defines operational logic to update a persistent-looking '关注列表' by reordering entries, capping them at 10, and replacing items, which is a form of state/configuration modification inconsistent with the earlier non-modification claim.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file defines activation and usage exclusively through Chinese-language phrases such as "AI媳妇" and provides no indication that users may interact in other languages. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale constraint is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The entire skill description, headings, workflows, and output conventions are written exclusively in Chinese, with no indication that users may choose another language or locale. Under the language/locale policy, forcing a single language without opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document asserts that the skill is effectively read-only and will not perform unattended writes, yet later sections direct automatic recording to PREDICTION_TRACKER.md and log files. This contradiction can mislead users and reviewers about side effects, causing unexpected persistent file modifications and weakening trust boundaries around what the skill may do.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill specifies automatic logging of predictions and verification results to tracker or log files without prominently disclosing persistent storage behavior in the main description. Hidden or under-disclosed writes can surprise users, leak sensitive operational history, and create integrity/privacy issues if logs accumulate market decisions or user-linked activity.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The top-level documentation says the adapter provides a uniform output format across markets and shows usage for both US and A-share markets. In code, main() hard-codes market = "美股" at L267, only the realtime CLI path is implemented, and analyze_us_stock() returns raw source-specific payloads rather than the documented normalized schema.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains natural-language instructions, usage text, and runtime messages that assume Chinese as the only supported language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python script = os.path.join(GS_SCRIPTS_DIR, "gs_stock_market_query.py") try: result = subprocess.run( ["python3", script, "single_hq", "--code", symbol, "--set_code", str(set_code)], capture_output=True, text=True, timeout=20, env={**os.environ}
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python script = os.path.join(GS_SCRIPTS_DIR, "gs_stock_market_query.py") try: result = subprocess.run( ["python3", script, "past_hq", "--code", symbol, "--set_code", str(set_code), "--want_nums", str(days)], capture_output=True, text=True, timeout=20, env={**os.environ}
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. The user-facing docstring and CLI help text throughout the file are Chinese-only, which effectively forces a specific language without indicating that users can choose an alternative.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language instructions explicitly require outputs to follow detected input language and target-market language automatically. This imposes a language/locale behavior on users without indicating any option to choose a preferred language, which matches the policy's language-choice concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module-level description states that the market's language changes automatically and the entire user-facing interface is written in Chinese, with no indication that users can select another language. This is a natural-language locale policy issue because the skill imposes a specific language context rather than offering a choice or clearly documenting a justified regional limitation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The comments at L150-L152 state that market detection only runs on explicit user requests and is not auto-triggered, and the docstring at L260-L264 says detection only returns a suggestion and will not switch automatically. However, the same module includes switch_market(), which persists changes by writing both .current_market and market_config.json at L89-L94. This creates intent confusion in the documentation about whether the component is purely advisory or can perform state-changing switches.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring presents the tool entirely in Chinese and hard-codes market names and usage in Chinese for UK, Japan, and Germany. Because this file targets multiple non-Chinese markets yet provides no opt-in or alternative locale, it creates a natural-language locale policy issue under the rule for forced language without user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Nearly all printed headings, prompts, and analytical output are fixed Chinese strings, which forces a specific language on users at runtime. The file does not provide a language setting, opt-in, or documented justification for this locale restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code file contains user-facing descriptions that state behavior and interaction entirely in Chinese, including the core activation condition. Under the policy, forcing a specific language or locale without offering user choice is a natural-language policy violation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The comments and security claims state that all watchlist modifications require user confirmation, but the CLI directly performs state-changing actions for commands like confirm_add and confirm_remove without verifying any prior confirmation token or interactive consent. In an agent or automation context, this misleading guarantee can cause unsafe integration assumptions and enable unauthorized modification of the watchlist if the script is invoked programmatically.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The function documentation says additions should occur only after user confirmation, but the CLI includes an add --force path that sets confirmed=True and bypasses any real confirmation workflow. This creates a straightforward authorization bypass for any caller able to execute the script, undermining the stated safety control.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script emits user-facing prompts, warnings, usage text, and status messages only in Chinese. Because the file does not offer language selection or clearly justify a Chinese-only scope, this violates the language/locale policy.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file-level docstring describes the skill entirely in Chinese and brands it with a Chinese-only persona/name, with no indication that other languages are supported or that the user can choose the locale. This is a natural-language locale policy concern because the skill presents a fixed language context rather than documenting language choice or a justified region-specific restriction.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The security comments state that API keys 'will not be automatically read from environment variables' and must be provided via CLI or interactive input. However, later code explicitly reads from os.environ to populate the subprocess environment (at least PATH), contradicting the blanket claim that environment variables are not read. This is an intent/documentation contradiction relevant to security expectations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
With no manifest available, the only stated purpose comes from the file docstring: generating trading plans from templates and data. The implementation executes another script in a separate skill directory via subprocess, which is a broader capability than local plan assembly and introduces external code execution dependency not justified by the limited in-file description alone.
- Content
Static analysis
No suspicious patterns detected.