T09 · Insecure Skill Coding Practices
Error
- Location
scripts/web_app.py:16- Finding
Authentication Bypass Through a Publicly Known Flask Session-Signing Key
- Content
View full analysis
- Remediation
View remediation
Security audit
A Stock Monitor 1.1.2
Security checks for vulnerabilities and agentic risk
Overview
The skill is a plausible A-share stock monitor, but its bundled web app is unsafe to expose because it ships with public admin credentials, a fixed session secret, and debug mode on all network interfaces.
Treat this as a Review item. Do not expose the Flask app to any network until you replace all default accounts, generate a unique SECRET_KEY from an environment variable, disable debug mode, bind to localhost or put it behind real authentication, and verify user persistence works. Review cron jobs and local database paths before enabling automation, and do not rely on its market recommendations without independent validation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/web_app.py:77- Finding
Remote Administrator Compromise Through Fixed Default Credentials
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/web_app.py:664- Finding
Passwords Stored Using Unsalted, Fast SHA-256 Hashes
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/web_app.py:1021- Finding
Flask Development Server and Debugger Exposed on All Network Interfaces
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/web_app.py:492- Finding
State-Changing Authenticated Routes Lack CSRF Protection
- Content
View full analysis
', methods=['DELETE']) @login_required def api_remove_from_watchlist(code): """从监控列表移除股票""" if code not in WATCHED_STOCKS: return jsonify({'status': 'error', 'message': '该股票不在监控列表中'}) WATCHED_STOCKS.remove(code) save_watchlist() ``` Other sensitive state-changing routes follow the same pattern, including user creation, user deletion, and password changes. Authentication is persistent: ```python login_user(user, remember=True) ``` No CSRF middleware or per-request CSRF token validation is configured in the reviewed application. ### Technical Analysis `@login_required` establishes that a user is authenticated but does not establish that a state-changing request was intentionally initiated by that user. The application relies on browser cookies and creates persistent login sessions, while sensitive POST and DELETE handlers do not validate a CSRF token or request origin. Several routes expect JSON or non-simple HTTP methods, which limits direct exploitation ...[truncated 1600 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/hybrid_data_source.py:154- Finding
Market Data Retrieved Over Unencrypted HTTP
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (66)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The supplied code is narrowly focused on data acquisition: connecting to Tushare if configured, retrieving single/batch real-time prices from Sina/Akshare, and loading historical OHLCV/amount data from Tushare/Akshare. This is consistent with a supporting market-data layer, but not with the declared end-user system description. The declared purpose promises a complete quantitative monitoring and decision system with analytics, strategy engines, recommendation outputs, automation, and UI components. None of those higher-level behaviors appear in this code chunk. There is no evidence of sentiment scoring, stock ranking, selection logic, signal generation, stop-loss/take-profit computation, scheduled tasks, backtest workflows, or web-serving code. Therefore the description materially overstates what this code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a full-featured A-share quant platform with analytics, data collection, recommendations, monitoring, and UI/automation components. The actual code chunk is a narrow utility script whose sole purpose is determining whether the current time is within certain trading sessions and returning a status via stdout/exit code. This is not merely a supporting detail of the declared system when evaluated in isolation: the primary behavior of the supplied code is much smaller in scope and does not demonstrate the major claimed capabilities. There is no suspicious undeclared behavior beyond time checking, but there is a strong description-to-behavior mismatch because the supplied code does not substantiate the declared functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code is related to one declared sub-feature—7-dimension market sentiment scoring for A-shares—and does process broad market stock data consistent with that portion of the description. However, the declared purpose describes a much broader end-user capability set centered on a full quantitative monitoring and stock recommendation system, while this code chunk only performs sentiment aggregation and returns a score plus statistics. It does not implement stock screening strategies, recommendations, monitoring, rankings, trading signal calculations, risk controls, UI, cron scheduling, or backtesting. Additionally, one advertised sentiment dimension (trend relative to MA20) is not actually computed and is instead fixed at a neutral default. Therefore, the description materially overstates what this supplied code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The description presents a comprehensive quantitative trading/stock selection platform, but this code chunk only provides data access utilities: trading-time checks, real-time quote retrieval, batch quote retrieval, and historical data retrieval via an underlying HybridDataSource. These are supporting data-layer functions, not the described end-user system capabilities. There is no evidence here of sentiment scoring, multi-strategy selection, automated recommendations, stop-loss logic, rankings, web UI, cron jobs, or backtesting. While the code is plausibly a component of such a system, the supplied chunk does not accurately represent the broad declared functionality, so this is a material description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a comprehensive A-share quantitative analysis and stock recommendation platform. However, this code chunk only implements a narrow supporting function: conditionally running a market-data update during trading hours. While data collection/update is consistent with part of the described system, the actual behavior of this chunk is far more limited than the declared purpose and does not demonstrate most of the headline capabilities. Therefore, the description does not accurately represent what this supplied code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The declared description presents a full-featured quantitative monitoring and stock-picking platform. The supplied code chunk, however, is limited to data acquisition, simple caching, historical/fund-flow retrieval, and bulk market snapshot ingestion. While these behaviors are supportive of such a system, this chunk does not implement the core advertised capabilities such as scoring, strategy-based stock selection, signal generation, risk management, recommendations, web UI, or backtesting. There is no evidence of unrelated malicious behavior or inconsistent resource access; the mismatch is that the actual code is a narrower data-fetching component rather than the described end-user quantitative analysis system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description presents a full-featured quantitative stock monitoring and recommendation platform, but the supplied code chunk is narrowly scoped to data persistence and retrieval in SQLite. Its primary purpose is cache/database management, not quantitative analysis, recommendation, monitoring orchestration, or backtesting. While a cache layer could be a supporting component of such a system, this chunk by itself does not substantiate most of the declared high-level capabilities. Therefore the description materially overstates what this code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description presents a full-featured A-share quantitative monitoring and stock-selection system with data acquisition, analytics, automation, UI, and recommendation capabilities. The supplied code chunk does not implement those system behaviors; it merely stores strategy/risk/indicator configuration constants and provides simple lookup helper functions. Some declared ideas are partially reflected conceptually—such as short-term vs long-term strategies, dynamic ATR stop-loss/take-profit, buy/sell signal scoring weights, and recommendation mappings—but the primary behavior in this chunk is configuration management, not an operational monitoring/selection platform. There is also a concrete quantitative discrepancy: the description claims 5 short-term plus 7 medium/long-term strategies, while the code defines 5 short-term and only 5 long-term strategies. Therefore the description materially overstates what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code is related to the declared stock-monitoring platform and does include a web interface, historical data access, backtesting, watchlist management, and some market sentiment/selection endpoints. However, this chunk also implements substantial undeclared capabilities centered on authentication, authorization, and user administration, including login/logout, roles, password changes, user CRUD, and persistence of user data. Those are material capabilities not mentioned in the declared description. Additionally, one endpoint (/api/market/sentiment) is exposed without login protection, which differs from the generally described monitored web system behavior. So while the code is broadly in-domain, the description does not accurately represent the full behavior of this code chunk.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 编辑 `web_app.py`，修改 `WATCHED_STOCKS` 列表：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 编辑 `web_app.py`，修改 `WATCHED_STOCKS` 列表：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 编辑 `web_app.py`，修改 `WATCHED_STOCKS` 列表：
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Publishing a default password in public-facing API documentation is a real security issue because users often leave defaults unchanged, especially for local or internal services. In this skill's context, the service exposes trading-related data and automation features, so reuse of the documented credential could allow unauthorized access wherever the app is reachable beyond a strictly isolated localhost setup.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The authentication section instructs operators to edit source code and hardcode the password directly in
web_app.py. Hardcoded secrets are easily leaked through version control, backups, logs, screenshots, and shared packages, and they discourage rotation and secure deployment practices.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The document publishes a default administrative username and password in cleartext without any warning or requirement to change them. If this skill is installed as documented and the web service is reachable beyond localhost through port forwarding, reverse proxies, or misconfiguration, attackers could gain unauthorized admin access immediately using known credentials.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html {% block content %} <div class="container-fluid py-4"> <!-- 1. 市场情绪 (置顶) --> <div class="panel mb-4"> <div class="panel-header"> <div class="panel-title">
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill advertises executable Python scripts, local SQLite storage, and external data-fetching packages, but does not declare any tool scope such as allowed-tools or permissions. That omission weakens reviewability and least-privilege enforcement because consumers cannot easily tell that the skill will read/write local files and make network requests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation instructs users to start a local web server, schedule recurring cron jobs, and use a SQLite cache/database, but does not clearly warn that the skill will create or modify local files and may run continuously in the background. This reduces informed consent and can lead users to deploy persistent automation and data collection without understanding storage, resource use, or operational exposure.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document says authentication is required, yet all curl, jQuery, and Python examples call protected endpoints without any auth material. This inconsistency strongly suggests either authentication is not actually enforced or integrators will implement clients that assume unauthenticated access, increasing the chance of accidental exposure of market-monitoring data and any adjacent privileged functionality.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The entire skill documentation is written in Chinese and does not indicate that users may choose another language or locale. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Natural-language policy review applies to all file types, including markdown. This file forces a specific language/locale experience for all users by presenting all instructions in Chinese and does not provide an opt-in, alternative language, or a documented justification that the skill is intended only for a Chinese-speaking or region-specific audience.
- Content
Internal Network Request
Medium
- Category
- Server-Side Request Forgery
- Confidence
- 70% confidence
- Finding
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
- Content
python import requests response = requests.get('http://localhost:5000/api/market/sentiment') data = response.json() print(f"市场情绪: {data['level']} {data['emoji']}")
Internal Network Request
Medium
- Category
- Server-Side Request Forgery
- Confidence
- 70% confidence
- Finding
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
- Content
python import requests response = requests.get('http://localhost:5000/api/market/sentiment') data = response.json() print(f"市场情绪: {data['level']} {data['emoji']}")
Internal Network Request
Medium
- Category
- Server-Side Request Forgery
- Confidence
- 70% confidence
- Finding
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
- Content
python import requests response = requests.get('http://localhost:5000/api/market/sentiment') data = response.json() print(f"市场情绪: {data['level']} {data['emoji']}")
Internal Network Request
Medium
- Category
- Server-Side Request Forgery
- Confidence
- 70% confidence
- Finding
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
- Content
python import requests response = requests.get('http://localhost:5000/api/market/sentiment') data = response.json() print(f"市场情绪: {data['level']} {data['emoji']}")
Static analysis
No suspicious patterns detected.