yingmi-skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:21 AM UTC
• Version: 0.1.5

Overview

The finance skill is plausibly legitimate, but it delegates core behavior to mutable remote instructions and asks users to install privileged CLI software and handle login credentials.

Install only if you trust Yingmi/Qieman, the yingmi-skill-cli package source, the registry mirror, and the remote sub-skills it loads. Avoid sudo/global installation where possible, treat phone numbers, SMS codes, and apiKeys as sensitive, and do not open generated reports with external resources enabled unless third-party asset and script loading is acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:88

Finding

Mutable Remote Skill Instructions Control Agent Behavior

Content

View full analysis

yingmi-skill-cli remote-skill exec --script 'cat SKILL.md' ``` The surrounding requirements direct the Agent to read the remotely supplied `SKILL.md` before continuing and to use that document as the authoritative source for subsequent workflow, report structure, fields, tool calls, and conclusion boundaries. ### Technical Analysis The locally audited Skill does not contain the effective instructions for its primary analysis workflows. Instead, it delegates control to mutable documents obtained through `yingmi-skill-cli remote-skill`. No immutable version, cryptographic digest, digital signature, trusted-key validation, or locally enforced action policy is specified for the retrieved `SKILL.md`. Consequently, the effective behavior can change after the local package has been reviewed. This creates an instruction-hijacking boundary: content controlled by the remote service is interpreted as Agent instructions rather than untrusted data. Compromise of the remote service, CLI distribution, publisher credentials, or a particular remote Skill could introduce instructions that request sensitive files, invoke additional tools, alter conclusions, or transmit data. ### Attack Path 1. An attacker compromises or gains publishing access to a remote sub-Skill or its delivery service. 2. The attacker modifies the remotely served `SKILL.md` to include unauthorized instructions. 3. A user submits a normal financial analysis or report-generation request. 4. The local Skill invokes `remote-skill list`, enters the selected Skill, and retrieves its `SKILL.md`. 5. The Agent treats the retrieved document as authoritative instructions. 6. The malicious instru ...[truncated 608 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: references/demo-report.html:54

Finding

Mandatory Third-Party Branding and Remote Asset Injection in Generated Reports

Content

View full analysis

``` ```html

Powered by Yingmi MCP · {{date}}

``` The associated requirements in `SKILL.md:127-130` and `references/HTML视觉模板.md:11-18,37-49` require generated reports to preserve the watermark, brand icon, template structure, and attribution. ### Technical Analysis The Skill requires persistent third-party branding in complete HTML reports and prohibits its removal. This modifies the Agent's final output independently of whether the user requested such branding. The required image is loaded from `asset2.qieman.com`. Each time a generated report is opened with network access, the viewer's browser may contact that host. The request can disclose the viewer's IP address, access time, user-agent metadata, and potentially referrer information. It also means the report is not genuinely self-contained. Because the remote image remains controlled by a third party, its content can change after report generation. Although an image load does not normally execute script, it creates an unnecessary external dependency and tracking surface. ### Attack Path 1. A user requests a complete HTML financial report. 2. The Skill ...[truncated 778 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/CLI前置检查.md:47

Finding

Unpinned Global CLI Installation with Root Privileges

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/demo-report.html:13

Finding

Generated Reports Load Third-Party JavaScript Without Integrity Protection

Content

View full analysis

``` The template requirements direct generated HTML reports to reuse the template and permit retaining this external ECharts dependency. ### Technical Analysis The report loads executable JavaScript from jsDelivr whenever the document is opened. Although the URL specifies ECharts version `5.5.0`, the HTML does not include a Subresource Integrity hash. The report therefore does not cryptographically verify that the returned bytes match an audited artifact. If the CDN account, package artifact, delivery infrastructure, DNS resolution, or trusted TLS endpoint is compromised, modified JavaScript can execute in the report's browser context. The report also lacks a restrictive Content Security Policy that would limit the behavior of a compromised dependency. Because financial reports may contain sensitive portfolio or household information in their DOM, third-party script execution has access to report contents. ### Attack Path 1. An attacker compromises the CDN delivery path or the dependency artifact served at the referenced URL. 2. The attacker substitutes malicious JavaScript for the expected ECharts library. 3. A generated report retains the external script element. 4. A recipient opens the report while connected to the network. 5. The browser downloads and executes the substituted script. 6. The script reads report data or browser-accessible metadata and transmits it to an attacker-controlled endpoint. ### Impact Assessment Successful exploitation provides JavaScript execution within the generated report's origin and browser context. The payload could read the report DOM, alter financial conclusions, display deceptive content, or transmit ...[truncated 259 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是一个面向金融数据查询与资产分析的综合能力 Skill，但实际代码片段的唯一功能是检查该 Skill 是否存在新版本。这属于与声明主用途明显不同的行为。代码访问的资源也是远端仓库的 SKILL.md 版本信息，而不是基金、策略、公告或财经数据源。虽然版本检查可被视为辅助维护能力，但当前代码片段本身并未体现声明中的任何核心业务能力，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

3. 执行 `scripts/check-upgrade.sh` 检查 Skill 更新。

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs use of shell commands and scripts (node -v, git --version, scripts/check-upgrade.sh, CLI invocations) but does not declare any explicit tool scope such as allowed tools or permissions. This creates an authorization ambiguity where an agent may execute shell actions not clearly constrained by the manifest, increasing the chance of unintended command execution or environment interaction.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation scope is extremely broad, covering many common finance-related tasks and directing the agent to prefer this skill. Overbroad triggering can cause the skill to activate in contexts where shell use, remote-skill entry, or report generation are unnecessary, increasing the attack surface and the chance of risky side effects from incidental invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow explicitly instructs operators to collect a user's phone number and SMS verification code, which are sensitive authentication-related data, but provides no warning about minimizing retention, verifying user consent, or avoiding logging/transcript storage. In an agent setting, this increases the chance that secrets are exposed in chat history, tooling logs, or to unauthorized operators, enabling account takeover or privacy harm.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document says initialization will 'automatically write' an apiKey but does not warn that this creates a local credential file on disk or discuss its sensitivity, location, and access implications. Users or operators may unknowingly leave a reusable secret in a predictable config path, increasing risk of credential leakage through backups, weak file permissions, shared machines, or support/log collection.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The workflow instructs users to run a global package installation with sudo, which executes package install scripts and writes binaries as root. If the package, dependency chain, registry mirror, or network path is compromised, this can lead to full system compromise rather than user-level impact; the requirement to use sudo makes the skill context more dangerous because it normalizes privileged execution of externally fetched code.

Content

Scanner excerpt · references/CLI前置检查.md (reported line 58)May include surrounding context.

• 如果安装时因为权限不足失败，必须改用 sudo 重新执行：

bash

sudo npm install -g yingmi-skill-cli@latest --registry=https://registry.npmmirror.com --prefer-online

• 如果 yingmi-skill-cli upgrade --check-only 提示当前不是最新版本，也应执行上面的安装或更新命令，直到确认 CLI 已经升级到最新版本。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document declares lang="zh-CN", and the visible UI text throughout the template is exclusively Chinese, which imposes a specific language/locale by default. There is no indication in this file that users can choose another language or that the Chinese-only constraint is required for a region-specific compliance purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The skill description advertises the ability to generate charts and PDFs, and later documents report-generation flows, but it does not warn users that executing these tasks may create local output files. For markdown files, omission of warnings about behaviors affecting user data or system state is in scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

L39 明确规定“中文优先 Noto Sans SC / 思源黑体族”，属于自然语言层面的语言/locale 约束。文件中未说明这是仅面向中文场景的受限模板，也未提供用户可选择其他语言或 locale 的机制。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This shell script contains natural-language descriptions and all user-visible messages exclusively in Chinese. The policy explicitly calls for flagging language or locale constraints when a skill forces a specific language without user opt-in, and there is no indication here that the skill is region-specific or that users can choose another language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.