T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:37- Finding
Hard-Coded API Credential Exposed in Skill Documentation
- Content
View full analysis
- Remediation
View remediation
Security audit
行情研判（云端版）
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real A-share market-report workflow, but it needs Review because it exposes an API key and automatically reads and stores portfolio-derived data without clear per-run consent.
Install only if you are comfortable giving the workflow access to your IMA holdings/watchlist folder and storing a detailed portfolio-derived report in IMA. The publisher should remove and rotate the exposed API key, pin or verify dependencies, narrow triggers, and add explicit confirmation before reading portfolio data or uploading reports.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:27- Finding
Mutable and Unverified Third-Party Skill Dependencies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description advertises market analysis and report upload behavior without clearly warning users that generated outputs will be persisted to an external knowledge base. Lack of disclosure undermines informed consent and can lead users to trigger storage of sensitive derived financial information unintentionally.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The trigger phrases are broad enough to match ordinary market-analysis requests, which can cause the skill to activate unexpectedly. Because this skill reads holdings data and uploads reports, accidental invocation materially increases the chance of unintended data access and persistence.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill embeds a concrete API key directly in the documentation, which exposes a credential to any user of the skill and enables unauthorized use of the dependent Eastmoney service. In a cloud-executed workflow, leaked credentials can be abused at scale, incur cost, and potentially grant access to protected financial-data features or associated account resources.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs the agent to access a specific IMA folder containing holdings/watchlist data, which are sensitive personal financial records. Hard-wiring retrieval of that data broadens access beyond generic market analysis and can expose investment positions without clear consent or scope limitation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The markdown instructs reading holdings and watchlist data from the knowledge base without an explicit privacy warning or consent gate. Since portfolio composition is sensitive financial information, silent retrieval increases the risk of unauthorized processing or disclosure.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow authorizes reading portfolio/watchlist data and later storing derived analysis back into the knowledge base without confirmation or minimization controls. This creates a full sensitive-data pipeline where personal financial records are ingested, enriched, and persisted automatically, magnifying privacy and confidentiality risks.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The final report template preserves full per-stock holdings analysis, which can reveal detailed investment positions, diagnostics, and strategy recommendations. Persisting that level of granularity in a knowledge base increases the blast radius of any later unauthorized access or unintended sharing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instructions direct automatic upload of the final report to IMA without a clear warning that the data will be retained and may contain holdings-derived analysis. This can create unintended long-term storage of sensitive investment information and increase exposure if the knowledge base is shared or later queried by others.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill automatically uploads a compiled report that includes holdings-derived content, turning a transient analysis task into persistent storage of sensitive personal financial data. In context, this is more dangerous because upload is mandatory in the workflow and the user is not prompted to approve the transfer or retention.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The skill name, description, triggers, and operational instructions are entirely in Chinese, which effectively imposes a language constraint on use. The file does not offer an alternative language option or explicitly state that the skill is intentionally region/language-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The user-facing description and dependency descriptions are entirely in Chinese and specifically target A-share market analysis, but the manifest provides no indication that language is selectable or that Chinese is a documented locale constraint. This can violate a language/locale policy when a skill implicitly forces one language for all users without opt-in.
- Content