Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > Windows 下按键自动化通过 `ths-hotkeys.mjs`（Node 调用系统 COM SendKeys）实现；若 COM 被禁用，可退化为手工快捷键。
Security audit
10JQKA
Security checks for vulnerabilities and agentic risk
Overview
This skill is not malicious, but it automates a real trading client and stores trading-related records with weaker controls than a financial workflow should have.
Install only if you are comfortable with an agent sending keystrokes to Tonghuashun. Use a test or observation-only workflow first, avoid running it while logged into a live trading account unless you are watching the screen, require manual confirmation before any F12/order-entry step, and periodically delete or protect the generated logs under scripts/logs if they contain sensitive trading history.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > Windows 下按键自动化通过 `ths-hotkeys.mjs`（Node 调用系统 COM SendKeys）实现；若 COM 被禁用，可退化为手工快捷键。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > Windows 下按键自动化通过 `ths-hotkeys.mjs`（Node 调用系统 COM SendKeys）实现；若 COM 被禁用，可退化为手工快捷键。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > Windows 下按键自动化通过 `ths-hotkeys.mjs`（Node 调用系统 COM SendKeys）实现；若 COM 被禁用，可退化为手工快捷键。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `run-all.mjs` 仅在 **Windows + Node** 场景下执行 GUI 动作
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `run-all.mjs` 仅在 **Windows + Node** 场景下执行 GUI 动作
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/risk-calc.mjs`：风控仓位计算
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/trade-journal.mjs`：交易日志增查工具
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README explicitly instructs users to run Windows GUI automation against a live trading client and references a trading log tool, but it does not warn that these actions can simulate input, affect a real brokerage session, or write sensitive local records. In a retail trading context, missing disclosure materially increases the chance of unintended orders, account misuse, or accidental exposure of trading history because users may treat the commands as harmless utilities rather than actions with financial and privacy consequences.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 74% confidence
- Finding
The skill invokes powerful execution pathways (
exec, shell commands, Node scripts, AppleScript/PowerShell) but does not declare a restrictive tool scope in the manifest. That mismatch weakens policy enforcement and increases the chance the agent can access broader host capabilities than users or platform reviewers expect.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Broad natural-language trigger mappings like opening the app, checking stocks, or preparing orders can cause the skill to activate on commonplace phrases without sufficient disambiguation. In a trading context, accidental invocation is more dangerous than usual because it can navigate toward trade-entry screens and manipulate financial workflows.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
Defaulting unspecified user style to a 'short-term intraday' workflow creates ambiguous automation in a high-risk financial domain. When intent is underspecified, the skill may launch an active trading sequence rather than a passive information task, increasing the chance of unintended market actions.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The documented behavior expands from operating the THS client UI into local file handling, logging, journaling, batch processing, and strategy orchestration. This scope creep increases attack surface because a user invoking a stock-app automation skill may unintentionally authorize local data persistence and multi-step script execution unrelated to simple UI control.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill instructs persistent logging of trading activity, watchlists, parameters, and journaled user inputs to local files. These records can expose sensitive financial behavior and strategy information to other local users, backups, malware, or unintended retention beyond the immediate task.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill supports arbitrary local plan-file ingestion for
run-all.mjs, allowing execution behavior to be driven by local file contents rather than tightly bounded user intents. If an attacker can influence the referenced file or trick the user into using a crafted plan, the skill could perform unexpected automated actions, broadening from stock UI assistance into local workflow execution.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file's natural-language strings and usage documentation are entirely in Chinese, including the title, usage text, and later runtime error messages. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is clearly documented and justified as region-specific, which is not present here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script launches PowerShell with '-ExecutionPolicy Bypass' to execute dynamically constructed commands for sleeping, activating the app, and COM-based SendKeys automation. Even though current inputs are somewhat constrained, bypassing execution policy weakens host protections and normalizes unrestricted script execution inside a skill that automates financial software, increasing risk if the script is modified, repurposed, or run in a sensitive environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This script performs live GUI automation against a stock-trading client by activating the 同花顺 window and sending keystrokes such as navigation, quote lookup, and entrust-related actions. In a trading context, keystroke injection without an explicit confirmation gate or visible dry-run mode is dangerous because focus mistakes, unexpected UI state, or chained automation can trigger unintended market actions on a real account.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file content is fully Chinese-language and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. This can constitute a natural-language policy issue when a specific language is effectively forced without opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This JSON manifest includes a user-facing note in Chinese while the rest of the file uses English identifiers, and it does not indicate that language selection is optional. Under the policy rule for language or locale constraints, this can be interpreted as imposing a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The comments are written only in Chinese ('同花顺批量巡检示例清单', '支持注释行，脚本会自动忽略'), which imposes a language choice in the file's natural-language instructions without indicating any user language option. The policy for this audit flags language or locale constraints when they are not explicitly optional or justified.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/run-all.mjs:201
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/ths-hotkeys.mjs:86