fund-fee-calc

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:24 PM UTC
• Version: 1.0.0

Overview

The skill itself is a local fund-fee calculator, but its documented one-command global install uses mutable, unpinned remote execution that users should review before installing.

Install only if you are comfortable with the unpinned global `npx` installer or use a safer manual/pinned install method. Treat calculator outputs as preliminary only, especially for unusual numeric inputs, and do not rely on it for investment, legal, or regulated compliance decisions without professional review.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:82
• Finding: Unpinned Third-Party Package Execution During Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:82` **Vulnerability Type**: Unpinned executable dependency and mutable supply-chain source **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The documented installation command invokes the `skills` npm package through `npx` without specifying an exact package version or verifying its integrity. If the package is not already available locally, `npx` can retrieve and execute it from the configured npm registry. The command also identifies the Skill repository without pinning an immutable commit or release artifact. Consequently, the npm CLI implementation and repository content executed or installed at a later date may differ from the versions that were reviewed. This is a conditional supply-chain vulnerability: exploitation requires compromise or malicious modification of the referenced npm package, its publisher account, the package registry path, or the mutable upstream repository. ### Attack Path 1. An attacker compromises the publisher account, package distribution path, or upstream repository used by the installation process. 2. The attacker publishes a modified `skills` package version or changes the repository content referenced by the command. 3. A user follows the documented installation instructions and runs the unpinned `npx` command. 4. `npx` downloads and executes the current package implementation with the invoking user's privileges. 5. The compromised installer can modify files accessible to that user, install altered Skills globally, access user-readable data, or run additional commands. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the user running the command. The affected scope includes files, credentials, environment variables, and development resources accessible to that account. Because the command requests global Skill installati ...[truncated 286 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the installer package to an exact audited version, rather than executing the latest available release: ```bash npx --yes skills@<audited-version> add <source> -g ``` 2. Pin the Skill source to an immutable commit hash or signed release tag. 3. Publish and verify a cryptographic checksum or signature for the downloaded release artifact. 4. Prefer local or user-scoped installation instead of global installation unless global scope is explicitly required. 5. Document that the installer executes third-party code and state the permissions and files it may access. 6. In security-sensitive environments, download and inspect the installer package before execution, then install with npm lifecycle scripts disabled where compatible. 7. Add automated dependency provenance, signature, and integrity checks to the release process. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fund_fee_calc.py:5
• Finding: Invalid and Non-Finite Financial Inputs Produce Successful Misleading Results<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fund_fee_calc.py:5-22` **Vulnerability Type**: Insufficient numeric input validation **Risk Level**: Medium ### Vulnerable Code ```python ap.add_argument("--amount", type=float, required=True, help="本金") ap.add_argument("--mgmt", type=float, default=0.0, help="年管理费率(如0.015)") ap.add_argument("--custody", type=float, default=0.0, help="年托管费率") ap.add_argument("--sales", type=float, default=0.0, help="年销售服务费率") ap.add_argument("--years", type=float, default=1, help="持有年数") ap.add_argument("--yield", dest="yld", type=float, default=0.0, help="预期年化收益(仅演示)") ap.add_argument("--claim", help="宣传口径文本，如 保本保收益") ap.add_argument("--json", action="store_true") a = ap.parse_args() if a.amount <= 0 or a.years <= 0: ap.error("--amount 与 --years 必须为正数") problems = [] if a.claim: bad = [k for k in ("保本", "稳赚", "无风险", "保证收益") if k in a.claim] if bad: problems.append("宣传含" + "、".join(bad) + "——资管新规禁止保本保收益承诺") fee_rate = a.mgmt + a.custody + a.sales fees = a.amount * fee_rate * a.years gross = a.amount * a.yld * a.years net = gross - fees ``` ### Technical Analysis All numeric arguments use Python's unrestricted `float` parser. The code checks only whether `amount` and `years` are less than or equal to zero. It does not verify that any numeric value is finite, and it does not reject negative management, custody, or sales fee rates. Python accepts strings such as `nan`, `inf`, and `-inf` as floating-point values. A NaN value bypasses the positivity validation because comparisons involving NaN are false. For example, `float("nan") <= 0` evaluates to false. Non-finite values then propagate through all fee and return calculations. Negative fee rates are also accepted and may create negative total fees, thereby increasing the reported net return. Unless a prohibited claim phrase is supplied, these malformed calculations still result in a PASS decision and exit code zero. In JSON mode, Python may em ...[truncated 1663 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate every numeric argument with `math.isfinite()` before performing calculations. 2. Continue requiring `amount` and `years` to be strictly positive after the finiteness check. 3. Require management, custody, and sales fee rates to be non-negative. 4. Define and enforce documented upper bounds for fee rates, holding periods, principal amounts, and expected yield. 5. Define whether negative expected yields are legitimate. If they are allowed, enforce a reasonable finite range; otherwise reject them. 6. Return usage error code 2 for all invalid numeric inputs. 7. Prevent non-standard JSON numeric output by rejecting non-finite values and optionally using: ```python json.dumps(result, allow_nan=False) ``` 8. Add regression tests for `nan`, `inf`, `-inf`, negative rates, zero values, extreme values, and valid negative-yield scenarios. A suitable validation pattern is: ```python import math numeric_values = { "amount": a.amount, "years": a.years, "mgmt": a.mgmt, "custody": a.custody, "sales": a.sales, "yield": a.yld, } for name, value in numeric_values.items(): if not math.isfinite(value): ap.error(f"--{name} must be a finite number") if a.amount <= 0 or a.years <= 0: ap.error("--amount and --years must be positive") if any(rate < 0 for rate in (a.mgmt, a.custody, a.sales)): ap.error("Fee rates must not be negative") ``` ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The installation instruction uses `npx skills add ...` without pinning an exact package/version, which can cause users to execute whatever package version `npx` resolves at runtime. If the package is updated maliciously, compromised upstream, or subject to dependency confusion/typosquatting, users may run untrusted code during install.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: This markdown file contains user-facing natural language primarily in Chinese, but it does not indicate that the language was selected by the user or provide an alternative language option. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The manifest uses a Chinese-only category value ("AI 治理"), which imposes a specific language/locale in user-facing metadata without indicating opt-in or that the skill is intentionally region-specific. This can violate language/locale policy requirements when a skill should remain language-neutral unless the locale limitation is explicit and justified.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The user-facing description, argument help text, and claim example are all presented only in Chinese. This imposes a specific language on users without any documented opt-in or alternative locale, which matches the language/locale policy violation criteria.

Static analysis

No suspicious patterns detected.