etf-monitor

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:14 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward ETF price monitor that fetches public quote data and prints alerts, with no hidden persistence, credential use, or destructive behavior found.

Install only if you are comfortable with the skill contacting Tencent Finance for public ETF quote data. Treat its alerts as advisory because the data source is requested over HTTP, and consider pinning dependencies or running it in a limited virtual environment before using it for any financial workflow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: etf-monitor.py:29

Finding

Market Data Retrieved over Unauthenticated Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: etf-monitor.py, lines 29-31
Vulnerability Type: Unauthenticated plaintext network communication
Risk Level: Medium

Vulnerable Code:

python

url = f"http://qt.gtimg.cn/q={symbols}"
      
resp = requests.get(url, timeout=10)

Technical Analysis

The application obtains the market prices used for alert decisions through plaintext HTTP. HTTP provides no server authentication or transport integrity, allowing an attacker with a network interception position to observe or modify the response.

The script immediately parses the returned values and uses them to calculate price changes without independently validating the response origin, quote timestamp, symbol association, or plausible price range. A forged response can therefore directly influence whether an alert is generated.

Attack Path

1. The Skill runs on a network that an attacker can intercept, such as a compromised gateway, hostile access point, proxy, or DNS environment.
2. The script requests ETF data from http://qt.gtimg.cn.
3. The attacker intercepts the request and returns a syntactically valid but manipulated quote response.
4. The script accepts the forged current and closing prices.
5. The manipulated values produce false alerts or suppress alerts for genuine market movements.

Impact Assessment

Exploitation does not directly grant local system privileges or code execution. Its scope is the integrity and reliability of all market-monitoring results produced by the Skill. An attacker can create false alerts, suppress legitimate alerts, and mislead downstream users or automated notification workflows that rely on the generated JSON.

Remediation

View remediation

Remediation Suggestions

• Replace the endpoint with an HTTPS-supported market-data API and retain normal TLS certificate verification.

• Do not disable certificate or hostname validation to preserve compatibility.

• If this provider does not offer HTTPS, migrate to a trusted provider that does.

• Validate the response status and expected content before parsing:

  python

  resp = requests.get(https_url, timeout=10)
  resp.raise_for_status()
  

• Validate returned symbols, quote timestamps, field counts, numeric ranges, and other invariants before using the data.

• Treat malformed, stale, or implausible responses as data-source failures rather than valid zero-change results.

T08 · Insecure Dependencies

Note

• Location: README.md:8

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 8-11; also declared in SKILL.md, lines 7-12
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code:

bash

pip install requests

The corresponding Skill metadata also declares the dependency without a version constraint:

yaml

"requires": {
  "pip": ["requests"]
},
"bins": ["python3"]

Technical Analysis

The project installs requests without a pinned version or cryptographic hash. Installation therefore resolves whichever release the configured package index considers current at installation time. This prevents reproducible dependency resolution and leaves the installation exposed to future compromised releases, unsafe index configuration, or unexpected incompatible updates.

The package name is legitimate and there is no evidence that the currently referenced dependency is malicious. The risk arises from the absence of version and integrity controls rather than from a known malicious package.

Attack Path

1. An attacker compromises the package publisher, a configured Python package index, or the dependency-resolution path.
2. The attacker causes a malicious or modified requests distribution to be selected.
3. A user or automated Skill installer executes pip install requests.
4. The unpinned dependency resolves to the attacker-controlled distribution.
5. Malicious package code executes during installation or when etf-monitor.py imports requests.

Impact Assessment

A compromised dependency can execute Python code with the privileges of the account performing installation or running the Skill. Depending on those privileges, this could permit access to that account's files, environment variables, network credentials, and available system resources. If installation is performed as root, the potential impact becomes system-wide.

Remediation

View remediation

Remediation Suggestions

• Pin requests to an explicitly reviewed version in both the documentation and Skill metadata.

• Maintain dependencies in a lock or requirements file with cryptographic hashes, for example:

  text

  requests==REVIEWED_VERSION --hash=sha256:VERIFIED_DISTRIBUTION_HASH
  

• Install with hash enforcement:

  bash

  python3 -m pip install --require-hashes -r requirements.txt
  

• Use a trusted package index over HTTPS and avoid untrusted extra indexes.

• Install dependencies in a dedicated virtual environment under a non-privileged account.

• Periodically review and deliberately update the pinned version after security testing rather than automatically resolving the latest release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill documentation is entirely presented in Chinese and does not indicate that other languages are supported or that the Chinese-only presentation is a required regional constraint. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill explicitly documents use of a network API, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates a capability/metadata mismatch that can bypass operator expectations, reduce sandbox policy clarity, and permit unintended outbound network access when the skill is executed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file’s natural-language description and usage instructions are presented only in Chinese, which can amount to forcing a specific language on users without opt-in. The policy allows locale constraints when they are explicitly justified, but this file does not state that the skill is intended only for Chinese-speaking or region-specific users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The only natural-language instructions and descriptions in the file are in Chinese, which imposes a specific language/locale without any opt-in or explanation that the skill is intended only for Chinese-speaking users. The policy requires either offering a language choice or clearly documenting and justifying the locale constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code sends an HTTP request to Tencent Finance to retrieve market data, but there is no user-facing disclosure beyond an internal docstring/comment that the script contacts an external service. For code files, network calls that transmit system or user context should have some visible warning, logging, or documented disclosure; here the request happens silently at runtime.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.