Security checks for vulnerabilities and agentic risk
Overview
This stock-analysis skill is mostly coherent, but it needs review because it gives concrete trading recommendations, includes an unsafe demo UI pattern, and tells users to install unpinned third-party packages.
Review before installing. Treat all stock outputs as educational or demo data, not financial advice. If you use the skill, install dependencies only in an isolated environment with pinned, verified packages, avoid hosting the demo page on a sensitive origin until the innerHTML issue is fixed, and provide any API key only for services you trust.
`;
showResult('stock-result', html);
}
```
The same unsafe pattern also affects the backtest and signal stock-code inputs later in the file.
### Technical Analysis
The value read from the `stock-code` input is directly interpolated into an HTML template. The resulting string is passed to `showResult`, which assigns it to the DOM through `innerHTML`.
Because no output encoding, HTML sanitization, or stock-code format validation occurs, the browser parses user input as markup rather than plain text. An attacker can therefore supply an HTML element containing an event handler, such as:
```html
```
When the result is rendered, the image fails to load and the injected `onerror` handler executes JavaScript in the page's origin.
### Attack Path
1. A victim opens `web.html` or a hosted copy of the interface.
2. The attacker persuades the victim to enter a crafted value into a stock-code field, or otherwise controls the field value.
3. The victim clicks the corresponding query, backtest, or signal button.
4. The application interpolates the malicious value into an HTML template.
5. `showResult` assigns that template to `innerHTML`.
6. The browser parses the injected element and executes its event handler in the application's origin.
### Impact Assessment
Successful exploitation perm
...[truncated 666 chars]
Remediation
View remediation
T08 · Insecure Dependencies
Warning
Location
SKILL.md:89
Finding
Unpinned and Unverified Third-Party Package Installation
The title and all user-facing documentation are written in Chinese, with no indication that other languages are supported or that the Chinese-only constraint is optional. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation unless clearly justified as region-specific.
Content
No source excerpt is available for this finding.
Internal Network Request
Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
Content
Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
Content
Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
Content
Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
The module docstring presents the skill name and usage only in Chinese, and the rest of the script's user-facing output is also Chinese-only. This creates a language policy concern because the skill effectively requires a specific language without opt-in, fallback, or documented locale restriction.
Content
No source excerpt is available for this finding.
subprocess module call
Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content
Scanner excerpt · scripts/check_status.py (reported line 14)May include surrounding context.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content
Scanner excerpt · scripts/check_status.py (reported line 26)May include surrounding context.
python
def test_api(port, endpoint):
"""测试 API 端点"""
try:
result = subprocess.run(
['curl', '-s', '-m', '2', f'http://localhost:{port}{endpoint}'],
capture_output=True,
text=True,
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
The HTML root sets lang="zh-CN", and all visible UI text is presented only in Simplified Chinese. Under the policy, forcing a specific language/locale without user opt-in is a natural-language policy violation unless the regional limitation is clearly documented and justified.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
The interface presents concrete stock trading outputs such as buy recommendations, target price, stop-loss, position sizing, and backtest performance without any disclaimer, risk warning, or indication that results are illustrative. In a finance-themed skill, users may reasonably rely on this guidance for real investment decisions, increasing the risk of financial harm through misplaced trust or overconfidence.
``` When the result is rendered, the image fails to load and the injected `onerror` handler executes JavaScript in the page's origin. ### Attack Path 1. A victim opens `web.html` or a hosted copy of the interface. 2. The attacker persuades the victim to enter a crafted value into a stock-code field, or otherwise controls the field value. 3. The victim clicks the corresponding query, backtest, or signal button. 4. The application interpolates the malicious value into an HTML template. 5. `showResult` assigns that template to `innerHTML`. 6. The browser parses the injected element and executes its event handler in the application's origin. ### Impact Assessment Successful exploitation perm ...[truncated 666 chars]