Security audit

新股申购助手

Security checks for vulnerabilities and agentic risk

Overview

This IPO assistant appears purpose-built, but it gives investment-style recommendations from mock or weakly verified data and has under-described token, dependency, network, and reminder behavior.

Review this carefully before installing. Treat its investment outputs as educational only, verify IPO details against official exchange or broker sources, avoid storing Tushare tokens in data/tushare_token.txt, install dependencies in an isolated environment with pinned versions, and do not enable reminders or notification forwarding unless you understand what will be scheduled and where messages will go.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: ipo_data_sources.py:23
Finding: Unauthenticated HTTP Allows IPO Data and Recommendation Tampering
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: ipo_data_sources.py:140
Finding: Plaintext Tushare Token File Can Be Accidentally Published
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:9
Finding: Unpinned Runtime Dependencies Create a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

other

Error

Location: ipo_prediction.py:9
Finding: Mock Financial Data Is Presented as Current Analysis and Prediction
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 15)May include surrounding context.
text
*.swo # Environment .env venv/ .venv/

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: References to automated reminders, persistent local configuration, and notification workflows indicate behaviors with persistence and outbound communication that are not clearly scoped in the skill metadata. In an agent setting, undocumented scheduling and notification capabilities can create unexpected background actions or data disclosure channels, making the skill more dangerous than a simple informational assistant.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: References to automated reminders, persistent local configuration, and notification workflows indicate behaviors with persistence and outbound communication that are not clearly scoped in the skill metadata. In an agent setting, undocumented scheduling and notification capabilities can create unexpected background actions or data disclosure channels, making the skill more dangerous than a simple informational assistant.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: References to automated reminders, persistent local configuration, and notification workflows indicate behaviors with persistence and outbound communication that are not clearly scoped in the skill metadata. In an agent setting, undocumented scheduling and notification capabilities can create unexpected background actions or data disclosure channels, making the skill more dangerous than a simple informational assistant.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: References to automated reminders, persistent local configuration, and notification workflows indicate behaviors with persistence and outbound communication that are not clearly scoped in the skill metadata. In an agent setting, undocumented scheduling and notification capabilities can create unexpected background actions or data disclosure channels, making the skill more dangerous than a simple informational assistant.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains natural-language instructions exclusively in Chinese, including the publishing workflow and operational guidance. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation unless the locale constraint is explicitly justified, which is not stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The entire skill description is written in Chinese, including headings, usage guidance, risk notes, and pricing, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares runtime dependencies and describes behaviors involving network access, local caching, and likely file operations, but it does not declare any explicit tool scope or permissions. This creates an authorization and transparency gap: a host may permit broader capabilities than users expect, and reviewers cannot easily verify whether network/file access is intentionally constrained.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description and main skill heading/content present the skill in Chinese and target A-share investors, but the file does not explicitly state that the skill is Chinese-language only or offer an opt-in language choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly documented and justified.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The code references an HTTP URL in the Referer header while the module also documents use of an HTTP API endpoint, indicating non-TLS communication with an external financial data source. Plain HTTP allows man-in-the-middle tampering or observation of traffic, so IPO data returned to the skill could be modified in transit and lead to incorrect recommendations or poisoned cached data.
Content: Scanner excerpt · ipo_calendar.py (reported line 38)May include surrounding context.
python
headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Referer': 'http://data.eastmoney.com/xg/xg/default.html', } try:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: The code uses plain HTTP in the Referer header for an external financial data source, and the API endpoint itself is also fetched over HTTP. This allows network attackers to intercept or tamper with traffic, potentially poisoning IPO data returned to the skill and affecting downstream analysis or investment recommendations. In this context, the skill is specifically meant to guide IPO investors, so integrity of externally fetched market data is important and makes the issue more significant than a generic low-risk metadata leak.
Content: Scanner excerpt · ipo_data_sources.py (reported line 35)May include surrounding context.
python
headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Referer': 'http://data.eastmoney.com/xg/xg/default.html', } try:

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This Python file contains only Chinese-language descriptions and output, and the reminder logic is tied to China-specific IPO workflows and the Asia/Shanghai timezone. Under the policy rule, forcing a specific language or locale without opt-in or explicit justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This Python file is a code file, so SQP-3 applies to natural-language strings in docstrings and output. The module docstring and subsequent user-facing messages are entirely in Chinese, with no opt-in, fallback, or explanation that the skill is region-specific, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The document references external data sources over plain HTTP, which exposes requests and responses to interception or modification by a network attacker. Because the skill relies on market and financial data, tampered responses could mislead downstream analysis, recommendations, or automation based on untrusted content.
Content: Scanner excerpt · references/API.md (reported line 12)May include surrounding context.
md
## 一、新股发行数据 ### 东方财富网 **URL**: http://data.eastmoney.com/xg/xg/default.html **数据内容**: - 新股申购列表

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide gives concrete investment strategies, expected returns, subscription recommendations, and timing suggestions such as when to sell, but it does not clearly state that the content is for informational/educational purposes only and not financial advice. In a retail-investing skill, this can cause users to rely on the output as personalized trading guidance, increasing legal/compliance risk and the chance of financial harm from unsuitable decisions.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/USER_GUIDE.md (reported line 227)May include surrounding context.
md
## 📚 学习资源 - 东方财富新股频道：http://data.eastmoney.com/xg/ - 巨潮资讯网：http://www.cninfo.com.cn/ - 新股申购入门书籍：《新股申购实战技巧》

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The file begins with a Chinese-only heading and the changelog content is written predominantly in Chinese, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script's user-facing messages are hard-coded in Chinese, including the failure notice and IPO summary output. Because the file provides no user opt-in or language selection, it creates a natural-language locale constraint that may violate language-choice policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code includes user-facing comments and printed messages in Chinese only, such as the failure and status outputs. Under the policy rule for language/locale, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This Python file contains user-facing natural-language descriptions solely in Chinese, including the module description and later recommendation strings, but does not indicate that the skill is China/Chinese-specific or provide any user opt-in for language. Under the policy rule, forcing a specific language without user choice can be a locale-policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This Python file contains natural-language documentation entirely in Chinese, indicating the skill is designed to operate in a fixed language/locale. The policy for SQP-3 says to flag language or locale constraints when the skill forces a specific language without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module name and descriptive text are entirely in Chinese, and the user-facing output strings later in the file are also fixed to Chinese. For a general-purpose skill file, this constitutes a locale/language constraint without any opt-in, choice mechanism, or justification that it is intended only for a Chinese-language or region-specific context.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest describes an IPO subscription assistant that provides calendars, analysis, predictions, and suggestions for A-share IPO investors. This module also writes historical IPO data to a local CSV file, which is a materially different behavior from providing analysis results and is not mentioned in the stated skill scope.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: For an IPO assistant focused on calendars, analysis, win-rate prediction, premium prediction, and subscription advice, writing arbitrary local files is not an obvious requirement. The export_to_csv function grants an additional persistence capability beyond the core analytical purpose described in the manifest.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file’s user-facing description and command help are written entirely in Chinese, indicating a fixed language choice for the skill. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.