T09 · Insecure Skill Coding Practices
Error
- Location
scripts/utils/predictor/evaluation.py:25- Finding
Unsafe PyTorch Checkpoint Deserialization Enables Arbitrary Code Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
alphaear-predictor
Security checks for vulnerabilities and agentic risk
Overview
This finance forecasting skill is purpose-aligned, but it needs review because it caches market/news data locally and has unsafe model-checkpoint loading that could run code if an untrusted model file is used.
Review this before installing. Use it only in an environment where model directories are controlled, do not place untrusted .pt checkpoint files under exports/models, and prefer fixing the loaders to require weights_only=True or a non-executable format. Expect local caching of stock, search, news, and signal data, plus outbound calls to market data, search, model, and configured LLM providers.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T01 · Skill Instruction Hijacking
Warning
- Location
scripts/utils/predictor/training.py:121- Finding
Untrusted Search and News Content Is Directly Embedded into LLM Instructions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (55)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the actual behavior is stock data collection/caching and database operations rather than forecasting, that is a meaningful capability mismatch. Undeclared data collection and persistence can have privacy, compliance, and integrity implications, especially in financial contexts where cached data may be stale, licensed, or sensitive.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
If the actual behavior is stock data collection/caching and database operations rather than forecasting, that is a meaningful capability mismatch. Undeclared data collection and persistence can have privacy, compliance, and integrity implications, especially in financial contexts where cached data may be stale, licensed, or sensitive.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the actual behavior is stock data collection/caching and database operations rather than forecasting, that is a meaningful capability mismatch. Undeclared data collection and persistence can have privacy, compliance, and integrity implications, especially in financial contexts where cached data may be stale, licensed, or sensitive.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the actual behavior is stock data collection/caching and database operations rather than forecasting, that is a meaningful capability mismatch. Undeclared data collection and persistence can have privacy, compliance, and integrity implications, especially in financial contexts where cached data may be stale, licensed, or sensitive.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
If the actual behavior is stock data collection/caching and database operations rather than forecasting, that is a meaningful capability mismatch. Undeclared data collection and persistence can have privacy, compliance, and integrity implications, especially in financial contexts where cached data may be stale, licensed, or sensitive.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the actual behavior is stock data collection/caching and database operations rather than forecasting, that is a meaningful capability mismatch. Undeclared data collection and persistence can have privacy, compliance, and integrity implications, especially in financial contexts where cached data may be stale, licensed, or sensitive.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
If the actual behavior is stock data collection/caching and database operations rather than forecasting, that is a meaningful capability mismatch. Undeclared data collection and persistence can have privacy, compliance, and integrity implications, especially in financial contexts where cached data may be stale, licensed, or sensitive.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the actual behavior is stock data collection/caching and database operations rather than forecasting, that is a meaningful capability mismatch. Undeclared data collection and persistence can have privacy, compliance, and integrity implications, especially in financial contexts where cached data may be stale, licensed, or sensitive.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the actual behavior is stock data collection/caching and database operations rather than forecasting, that is a meaningful capability mismatch. Undeclared data collection and persistence can have privacy, compliance, and integrity implications, especially in financial contexts where cached data may be stale, licensed, or sensitive.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the actual behavior is stock data collection/caching and database operations rather than forecasting, that is a meaningful capability mismatch. Undeclared data collection and persistence can have privacy, compliance, and integrity implications, especially in financial contexts where cached data may be stale, licensed, or sensitive.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the actual behavior is stock data collection/caching and database operations rather than forecasting, that is a meaningful capability mismatch. Undeclared data collection and persistence can have privacy, compliance, and integrity implications, especially in financial contexts where cached data may be stale, licensed, or sensitive.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the actual behavior is stock data collection/caching and database operations rather than forecasting, that is a meaningful capability mismatch. Undeclared data collection and persistence can have privacy, compliance, and integrity implications, especially in financial contexts where cached data may be stale, licensed, or sensitive.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the actual behavior is stock data collection/caching and database operations rather than forecasting, that is a meaningful capability mismatch. Undeclared data collection and persistence can have privacy, compliance, and integrity implications, especially in financial contexts where cached data may be stale, licensed, or sensitive.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the actual behavior is stock data collection/caching and database operations rather than forecasting, that is a meaningful capability mismatch. Undeclared data collection and persistence can have privacy, compliance, and integrity implications, especially in financial contexts where cached data may be stale, licensed, or sensitive.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 87% confidence
- Finding
If the actual behavior is stock data collection/caching and database operations rather than forecasting, that is a meaningful capability mismatch. Undeclared data collection and persistence can have privacy, compliance, and integrity implications, especially in financial contexts where cached data may be stale, licensed, or sensitive.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the actual behavior is stock data collection/caching and database operations rather than forecasting, that is a meaningful capability mismatch. Undeclared data collection and persistence can have privacy, compliance, and integrity implications, especially in financial contexts where cached data may be stale, licensed, or sensitive.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the actual behavior is stock data collection/caching and database operations rather than forecasting, that is a meaningful capability mismatch. Undeclared data collection and persistence can have privacy, compliance, and integrity implications, especially in financial contexts where cached data may be stale, licensed, or sensitive.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the actual behavior is stock data collection/caching and database operations rather than forecasting, that is a meaningful capability mismatch. Undeclared data collection and persistence can have privacy, compliance, and integrity implications, especially in financial contexts where cached data may be stale, licensed, or sensitive.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The execute_query method accepts arbitrary SQL and runs it directly against the application's SQLite database, allowing any caller to perform reads, writes, schema changes, or destructive operations. In an agent skill context, this materially increases risk because any upstream prompt-influenced or user-controlled input reaching this method could become a full database manipulation primitive.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises capabilities that imply environment access, file reads, and possible network/model downloads, but it does not declare any explicit tool scope or permissions. This creates an authorization and transparency gap: a host agent may invoke the skill without clear least-privilege boundaries, increasing the chance of overbroad access or unsafe execution assumptions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger text is broad: 'use when user needs finance market time-series forecasting or news-aware finance market adjustments.' Without stricter invocation boundaries, an agent may over-apply the skill to loosely related finance queries, causing unnecessary external access, model loading, or speculative outputs in inappropriate contexts. Broad triggers are especially risky in finance because outputs may influence decisions despite uncertain applicability.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language guidance in the class docstring is written entirely in Chinese and references following instructions in a related prompt file, which suggests a Chinese-language interaction pattern without offering any user language choice. Per policy, forcing a specific language or locale without opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The natural-language documentation is written entirely in Chinese and presents the utility's behavior in that locale without any indication that language selection is configurable or intentionally region-scoped. Under the policy, forcing a specific language without user opt-in is a locale policy issue.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code claims reduced supply-chain risk but still auto-selects the newest
kronos_news_*.ptfile from a writable local directory and may deserialize it unsafely. This creates a practical model-poisoning and code-execution path: an attacker can drop a newer malicious checkpoint that will be preferred automatically at startup.- Content
Insecure deserialization: torch.load() without weights_only=True
Medium
- Category
- Dangerous Code Execution
- Confidence
- 98% confidence
- Finding
The fallback
torch.load(latest_model, map_location=device)performs legacy PyTorch deserialization, which can execute attacker-controlled pickle payloads when loading a malicious.ptfile. In this skill, the file is chosen automatically as the newest matching checkpoint from a local directory, so anyone who can place or replace files there may gain code execution during model initialization.- Content
python except (TypeError, RuntimeError, AttributeError): # Fallback for older torch versions or complex objects if necessary logger.warning(f"⚠️ Safe loading failed. Falling back to legacy load for {latest_model}") checkpoint = torch.load(latest_model, map_location=device) # The checkpoint contains 'news_proj_state_dict' if 'news_proj_state_dict' in checkpoint: if not hasattr(model, 'news_proj') or model.news_proj is None: