T01 · Skill Instruction Hijacking
Error
- Location
profiles/投资明见_profile.json:65- Finding
Bundled profile directs the Agent to append promotional traffic-diversion content
- Content
View full analysis
- Remediation
View remediation
Security audit
股票分析专家-公众号股票大V蒸馏
Security checks for vulnerabilities and agentic risk
Overview
This stock-analysis skill is not clearly malicious, but it needs review because it can modify the runtime environment, send API-key-backed usage records, expose keys in logs, and let remote article text influence persistent profiles.
Before installing, review and preferably remove automatic pip installation and call recording, avoid passing REDFOX_API_KEY on the command line, run it in an isolated virtual environment, and manually inspect any profile updates or generated endings before reuse. Treat synced article text as untrusted data and all outputs as non-advisory financial commentary.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T01 · Skill Instruction Hijacking
Error
- Location
scripts/validate_profile.py:118- Finding
Untrusted remote article content is embedded into AI Agent task instructions without a trust boundary
- Content
View full analysis
500 else content lines.append(f"#### 文章 {i}：{title}") lines.append(f"- 发布日期：{pub}") lines.append(f"- 正文摘要（前500字）：") lines.append(f"```") lines.append(content_preview) lines.append(f"```") ``` Related remote-data interpolation also occurs in: - `scripts/sync_articles.py:129-153` - `scripts/sync_articles.py:193-200` - `scripts/stock_screen.py:198-215` - `scripts/portfolio.py:145-169` ### Technical Analysis Article titles, summaries, and body fields returned by the remote RedFox API are copied into Markdown files intended for subsequent AI Agent processing. The Skill does not establish a clear trust boundary stating that commands inside those fields are untrusted data and must never be followed. Markdown code fences are formatting syntax, not a security boundary. An article controlled by a malicious publisher, compromised data source, or compromised API response could contain instructions addressed to the Agent. When the Agent later reads the generated validation or synchronization task, those instructions may compete with the legitimate task instructions. The synchronization workflow is particularly sensitive because its output asks the Agent to assess and update bundled profiles. An injected instruction could therefore attempt to influence profile changes, although the reviewed code does not automatically perform those changes itself. ### Attack Pat ...[truncated 1147 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze.py:391- Finding
API key is exposed in child-process arguments and plaintext command logging
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/analyze.py:42- Finding
Environment check automatically installs an unpinned dependency into the active Python environment
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (33)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared functionality suggests broad multi-mode investment analysis, but the implementation context indicates narrower profile-validation and article-processing tasks. Such overclaiming is a security concern because it obscures the real trust boundary: users may expose API keys, approve network/file access, or rely on outputs without understanding the true data-processing workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared functionality suggests broad multi-mode investment analysis, but the implementation context indicates narrower profile-validation and article-processing tasks. Such overclaiming is a security concern because it obscures the real trust boundary: users may expose API keys, approve network/file access, or rely on outputs without understanding the true data-processing workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared functionality suggests broad multi-mode investment analysis, but the implementation context indicates narrower profile-validation and article-processing tasks. Such overclaiming is a security concern because it obscures the real trust boundary: users may expose API keys, approve network/file access, or rely on outputs without understanding the true data-processing workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The declared functionality suggests broad multi-mode investment analysis, but the implementation context indicates narrower profile-validation and article-processing tasks. Such overclaiming is a security concern because it obscures the real trust boundary: users may expose API keys, approve network/file access, or rely on outputs without understanding the true data-processing workflow.
- Content
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 96% confidence
- Finding
The environment check automatically executes
pip install requestsviaos.system, which performs a shell command and modifies the runtime environment without explicit user consent. In a skill whose stated purpose is stock analysis, silently installing packages expands the trust boundary, can execute package install hooks, and may enable supply-chain compromise or unexpected code execution on the host.- Content
python info("requests 已就绪") except ImportError: warn("缺少 requests，正在安装...") os.system(f"{sys.executable} -m pip install requests") try: import requests info("requests 安装成功")
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
For a markdown skill description, this phrasing suggests the skill may respond to unrestricted everyday-language requests without clearly defining when it should or should not activate. The file provides examples, but it does not state constraints, exclusion conditions, or a bounded trigger scope to prevent unintended invocation overlap with ordinary conversation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README says users can 'directly use natural language to describe needs' and provides broad trigger phrases such as analysis, stock picking, and review workflows. In an agent environment, overly broad invocation guidance can cause unintended activation in loosely related conversations, which may lead the skill to process financial requests unexpectedly or inject style-driven investment content where it was not intended.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill invokes shell commands, reads environment/config secrets, performs network access, and writes local files, but it does not declare any explicit tool scope or allowed-tools boundary. This creates unnecessary privilege ambiguity: an orchestrator may grant broader capabilities than needed, increasing the blast radius if the skill is misused or later modified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger list contains very broad finance phrases such as stock analysis, sector analysis, and stock picking, which can cause the skill to activate during ordinary financial discussion where the user did not intend to invoke a tool with network, shell, and file-write behavior. Because this is a finance skill tied to external syncing and API-backed operations, accidental activation can lead to unnecessary data access, charges, or confusing tool side effects.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The activation logic relies on broad natural-language intent matching without strong boundaries, making it easy for routine market conversation to be misclassified as a request to execute the skill. In this context, ambiguous activation is riskier because the skill can move from conversational analysis into external data retrieval and local-output generation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire template is written as a fixed Chinese article structure, including headings, disclaimers, and output instructions, with no indication that users may choose another language. This creates a natural-language locale policy issue because the skill appears to enforce a specific language by default rather than presenting it as an option.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Installing packages during an environment check is outside the narrow, user-expected purpose of generating stock analysis and is therefore a risky side effect. Even if intended as convenience, hidden installation behavior can surprise users, trigger network access, alter the Python environment, and introduce unreviewed third-party code at runtime.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Automatically installing packages without prior confirmation is unsafe because it causes code acquisition and execution as a side effect of a routine check. Users invoking a stock-analysis skill would not reasonably expect dependency installation to occur silently, and that mismatch makes accidental exposure to supply-chain or policy violations more likely.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python if sector: cmd.extend(["--sector", sector]) print(f"{BOLD}执行：{RESET}{' '.join(cmd)}") return subprocess.call(cmd) def run_portfolio(author, stocks, period=30):
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python if sector: cmd.extend(["--sector", sector]) print(f"{BOLD}执行：{RESET}{' '.join(cmd)}") return subprocess.call(cmd) def run_portfolio(author, stocks, period=30):
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python if sector: cmd.extend(["--sector", sector]) print(f"{BOLD}执行：{RESET}{' '.join(cmd)}") return subprocess.call(cmd) def run_portfolio(author, stocks, period=30):
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 77% confidence
- Finding
While this subprocess call is not shell-injectable, it forwards a sensitive
--api-keyvalue on the command line and prints the full command string beforehand. Command-line arguments can be exposed through process listings, logs, terminal history capture, or monitoring tools, making the API key easier to leak to other local users or logging systems.- Content
python if api_key: cmd.extend(["--api-key", api_key]) print(f"{BOLD}执行：{RESET}{' '.join(cmd)}") return subprocess.call(cmd) # ─── 主流程 ──────────────────────────────────────────────────────────────────────────
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script performs call reporting/telemetry by invoking
record_call(...)with API-backed behavior, but this capability is not clearly disclosed by the skill description. Because the tool is presented as an analysis assistant, sending usage metadata such as mode and selected authors creates an unexpected data egress path and weakens user trust and privacy expectations.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The code may transmit an API key and usage metadata without an obvious user-facing warning at the point of use. In the context of a stock-analysis skill, undisclosed outbound transmission is more dangerous because users are likely to assume local analysis behavior, not remote reporting of invocation details.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Invocation telemetry is not necessary to fulfill the skill's stock-analysis function, so this data transmission increases attack surface without clear product justification. In security terms, unnecessary outbound reporting creates avoidable privacy, compliance, and exfiltration risk, especially if future changes expand what is recorded.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code silently reports skill usage metadata to an external endpoint and includes the user's API credential in the request headers. Even if the destination is intended by the author, undisclosed telemetry and secondary transmission of credentials expands trust boundaries and can expose sensitive usage patterns or secrets if the service, logs, or intermediaries are compromised.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This POST sends data to an external service and includes the REDFOX API key in a custom header for a telemetry-style call unrelated to the primary article query path. Sending credentials and user activity metadata to an additional endpoint increases the chance of secret leakage, unauthorized correlation of user behavior, and misuse if that endpoint or its logging pipeline is compromised.
- Content
python payload["authors"] = str(authors) try: resp = requests.post( RECORD_API_URL, json=payload, headers={"Content-Type": "application/json", "REDFOX_API_KEY": api_key},
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file's natural-language instructions, usage examples, prompts, and generated content are all written to require Chinese output and Chinese-style commentary, but there is no indication that users can choose another language or locale. This is a language/locale policy concern because the skill imposes a specific language by default rather than offering an explicit opt-in.
- Content
Tainted flow: 'data' from pathlib.Path.read_text (line 77, file read) → pathlib.Path.write_text (file write)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python # 保存 today = datetime.now().strftime("%Y-%m-%d") f = output_dir / f"盘面数据_{today}.json" f.write_text(json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8") info(f"盘面数据已保存：{f}") # 显示摘要
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The module docstring, usage examples, CLI descriptions, and generated output language are all fixed in Chinese, which imposes a specific language/locale on users without any opt-in or alternative. The policy for this review flags language or locale constraints when the skill forces a specific language without user choice or documented justification.
- Content