T09 · Insecure Skill Coding Practices
Error
- Location
scripts/utils/predictor/evaluation.py:25- Finding
Unsafe PyTorch Checkpoint Deserialization Can Lead to Arbitrary Code Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
A股信号追踪
Security checks for vulnerabilities and agentic risk
Overview
The skill's main instructions fit finance signal tracking, but the package includes under-disclosed finance tooling that can use local databases, API keys, remote model downloads, and unsafe model checkpoint loading if run.
Install only if you are comfortable with a finance research package that includes broader experimental tooling than the tracker description suggests. Avoid running the predictor, training, or evaluation scripts on untrusted inputs, review any UST_URL and API-key configuration, and expect local SQLite caches/files to be created if the bundled utilities are used.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/utils/predictor/kline_generate.py:25- Finding
SQL Injection Through Direct Ticker Interpolation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/utils/llm/factory.py:82- Finding
API Credential and Prompt Data Can Be Forwarded to an Unrestricted Configurable Endpoint
- Content
View full analysis
"developer". Provide an explicit # role_map to ensure compatibility. default_role_map = { "system": "system", "user": "user", "assistant": "assistant", "tool": "tool", "model": "assistant", } # Allow callers to override role_map via kwargs, otherwise use default role_map = kwargs.pop("role_map", default_role_map) return OpenAIChat( id=model_id, api_key=api_key, base_url=os.getenv("UST_URL"), role_map=role_map, extra_body={"enable_thinking": False}, # TODO: one more setting for thinking **kwargs ) ``` ### Technical Analysis The UST provider reads a secret from `UST_KEY_API` and supplies it to an OpenAI-compatible client whose destination is taken directly from `UST_URL`. The code does not validate: - Whether the URL uses HTTPS. - Whether the hostname is an approved provider. - Whether the URL contains embedded credentials. - Whether it resolves to a loopback, private, or link-local address. - Whether redirects remain within an approved trust boundary. When the client performs a request, it can send both the API credential and the financial prompt content to the configured destination. The project uses external LLM processing for financial research and causality verification, so transmitted content may include user theses, company identifiers, research context, and derived analysis. This is not evidence that the c ...[truncated 1495 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/utils/predictor/training.py:35- Finding
Automatic Retrieval of Unpinned Remote Machine-Learning Artifacts
- Content
View full analysis
- Remediation
View remediation
" self.tokenizer = KronosTokenizer.from_pretrained( "NeoQuasar/Kronos-Tokenizer-base", revision=REVISION, local_files_only=True, ) ``` 2. Provision reviewed artifacts during deployment and disable automatic network fallback in production. 3. Verify artifact SHA-256 hashes or digital signatures before loading. 4. Prefer `safetensors` or another non-executable serialization format. 5. Apply an allowlist to `EMBEDDING_MODEL`; do not permit arbitrary repository selection through an untrusted environment value. 6. Set explicit cache directories with restrictive permissions. 7. Enforce download size limits, timeouts, and available-disk checks. 8. Pin and audit the versions of Hugging Face, PyTorch, Sentence Transformers, and related parsing dependencies. 9. Record model repository, immutable revision, digest, and loader version in generated evaluation metadata. 10. Treat any requirement for remote custom code as a separate code-execution boundary and keep it disabled unless the code has been independently reviewed. ]]>
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (109)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The repeated description-behavior mismatches indicate the skill is advertised as a narrowly scoped signal-tracking tool but is associated with much broader behaviors including arbitrary web fetching, database access, report generation, forecasting, and shell/file operations. This is dangerous because users and orchestrators may grant trust and routing decisions based on the manifest, while the implementation can exercise materially different capabilities and access more data than expected.
- Content
Static analysis
No suspicious patterns detected.