T08 · Insecure Dependencies
Warning
- Location
SKILL.md:426- Finding
Automatic Installation of an Unpinned Python Dependency
- Content
View full analysis
- Remediation
View remediation
Security audit
缠论股票分析投研报告
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent stock-report generator, but it automatically installs an unpinned Python package and relies on a mutable external finance-data skill that may handle a Tushare token.
Review before installing. Use it only in an environment where automatic Python package installation is acceptable, preferably isolated, and avoid exposing TUSHARE_TOKEN broadly. Treat generated buy/sell and position-size guidance as informational research output, not personalized investment advice.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:49- Finding
Unpinned External Skill Dependency
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description is written as a Chinese-only workflow and presents the skill as generating reports in Chinese without any opt-in or alternative locale. The policy for this audit flags language or locale constraints when a specific language is imposed without user choice.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly instructs runtime installation of a Python package via pip during execution. Even though reportlab itself is a common library, allowing a skill to install packages at runtime expands execution capabilities, introduces supply-chain risk, and can modify the host environment in ways unrelated to the core data-analysis task. In this context, PDF generation does not justify ad hoc package installation inside the skill workflow.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This section presents explicit buy/sell signals and operational guidance as if they are actionable trading instructions, but it does not include any warning that the material is educational, probabilistic, or unsuitable as personalized investment advice. In the context of a skill designed to generate professional stock research reports, this can cause users to over-trust the output and make risky financial decisions without appropriate suitability, uncertainty, or loss disclosures.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The scoring framework goes beyond analysis and recommends concrete trade actions and portfolio allocation ranges such as light, medium, or heavy positions. In a stock-analysis skill, this is especially risky because users may treat the generated report as fiduciary-style guidance, leading to concentrated exposure and financial loss without disclosure of uncertainty, liquidity, suitability, or regulatory constraints.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file states all version records in Chinese and links to Chinese-localized documentation, which indicates a fixed language choice in natural-language content. There is no indication that the language is optional, user-selectable, or justified as a region-specific skill, so this may violate language/locale policy requirements.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The manifest describes a stock analysis skill, but the documentation declares dependence on a Tushare token provided through the
TUSHARE_TOKENenvironment variable. Accessing environment-based credentials is a sensitive capability that is not surfaced in the manifest description itself, even though external finance data access is part of the workflow.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
A language or locale policy issue exists when content forces a specific language without user opt-in. This file is fully Chinese-language and does not state that the skill is China-region-specific or provide an alternative language option, so it may violate the stated natural-language policy criterion.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file title and all instructional content are written in Chinese, and there is no indication that users may choose another language or that the skill is restricted to a Chinese-speaking or region-specific audience. Under the policy rule for language or locale constraints, this can be considered a natural-language policy issue when no opt-in or justification is provided.
- Content
Static analysis
No suspicious patterns detected.