Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Security audit
Quant Data
Security checks for vulnerabilities and agentic risk
Overview
The skill performs its advertised stock-data queries and backtests through an openly identified external service, with no hidden local access or trading authority.
Stock queries, filters, and strategy settings are processed by zizhenghua.com. Submit only necessary, nonconfidential parameters; extra JSON fields are also forwarded. Confirm the provider's privacy and retention practices before sending proprietary strategies. All three artifact files were inspected, and the scanner's partial-coverage exception was resolved as a harmless header string.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: network.
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
The backtest workflow sends user-supplied strategy parameters to an external service without a privacy warning.
Medium
- Category
- Output Handling
- Confidence
- 88% confidence
- Finding
The backtest workflow forwards the complete user-supplied arguments to https://zizhenghua.com/api without a privacy notice or local field allowlist. Although remote processing is consistent with the advertised functionality and is not evidence of malicious exfiltration, proprietary strategy settings or additional sensitive fields could be disclosed without users understanding the recipient or its data-handling practices.
- Content