T08 · Insecure Dependencies
Warning
- Location
references/datasaver-setup.md:28- Finding
Unverified Third-Party Browser-Control Service Introduces Supply-Chain and Excessive-Access Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
A 股全流程量化决策系统
Security checks for vulnerabilities and agentic risk
Overview
This A-share analysis skill is mostly coherent, but it asks users to add scheduled monitoring, persistent trading memory, and an optional third-party browser-control MCP service with broad access implications.
Review before installing. Use the no-Datasaver workflow by default, avoid putting real browser cookies or bearer tokens in shared workspaces, and only configure Datasaver in a dedicated browser profile with no unrelated logged-in accounts. Do not enable cron or memory-writing workflows unless you want persistent trading records and automated financial alerts. Treat all buy/sell/stop-loss output as decision support, not guaranteed investment advice.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/error-handling.md:36- Finding
TLS Certificate Verification Can Be Disabled During Network Error Recovery
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (21)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 60% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
解决：
bash # 加 --ipv4 强制走IPv4 curl -s --max-time 10 --ipv4 -H "User-Agent: Mozilla/5.0" "https://..."curl: (28) Operation timed out
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 60% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
解决:
bash # 加 --ipv4 强制走IPv4 curl -s --max-time 10 --ipv4 -H "User-Agent: Mozilla/5.0" "https://..."curl: (28) Operation timed out
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list includes broad everyday finance phrases such as '买不买', '止损', and '复盘', which can cause the skill to activate in contexts broader than the author's intended scope. In a trading skill, accidental invocation is more sensitive because it may produce investment guidance, manipulate portfolio records, or trigger scheduled monitoring workflows when the user only meant to discuss markets generally.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This file presents all operational guidance in Chinese only, with no opt-in, alternative language, or justification that the content is intentionally limited to a Chinese-speaking or region-specific audience.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
资金流向（超大单/大单/中单/小单净额）
text 目标页面：https://data.eastmoney.com/zjlx/{股票代码}.html 示例：https://data.eastmoney.com/zjlx/603893.html（瑞芯微）
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
资金流向（超大单/大单/中单/小单净额）
text 目标页面：https://data.eastmoney.com/zjlx/{股票代码}.html 示例：https://data.eastmoney.com/zjlx/603893.html（瑞芯微）
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
资金流向（超大单/大单/中单/小单净额）
text 目标页面：https://data.eastmoney.com/zjlx/{股票代码}.html 示例：https://data.eastmoney.com/zjlx/603893.html（瑞芯微）
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
资金流向（超大单/大单/中单/小单净额）
text 目标页面：https://data.eastmoney.com/zjlx/{股票代码}.html 示例：https://data.eastmoney.com/zjlx/603893.html（瑞芯微）
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
资金流向（超大单/大单/中单/小单净额）
text 目标页面：https://data.eastmoney.com/zjlx/{股票代码}.html 示例：https://data.eastmoney.com/zjlx/603893.html（瑞芯微）
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
资金流向（超大单/大单/中单/小单净额）
text 目标页面：https://data.eastmoney.com/zjlx/{股票代码}.html 示例：https://data.eastmoney.com/zjlx/603893.html（瑞芯微）
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
资金流向（超大单/大单/中单/小单净额）
text 目标页面：https://data.eastmoney.com/zjlx/{股票代码}.html 示例：https://data.eastmoney.com/zjlx/603893.html（瑞芯微）
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
资金流向（超大单/大单/中单/小单净额）
text 目标页面：https://data.eastmoney.com/zjlx/{股票代码}.html 示例：https://data.eastmoney.com/zjlx/603893.html（瑞芯微）
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file title and all operational guidance are written exclusively in Chinese, with no indication that language selection is optional or that the skill is intentionally restricted to a Chinese-only audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file gives concrete buy/no-buy, stop-loss, and entry-screening instructions for real-money stock trading without any visible financial risk warning, suitability disclaimer, or reminder that losses can occur. In the context of an automated A-share trading-analysis skill marketed for '真金白银' decisions, the omission increases the chance that users over-trust heuristic signals as authoritative advice and suffer avoidable financial harm.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file uses Chinese throughout and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Per the policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The scheduled 收盘复盘 task explicitly instructs the agent to write learned mistakes and daily logs into memory/learnings.md and memory/YYYY-MM-DD.md automatically. Automatic persistent writes can alter long-term agent behavior or stored records without an explicit user confirmation step, creating a risk of memory poisoning, unwanted retention of sensitive trading data, and irreversible state changes from a routine cron job.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file contains user-facing instructions exclusively in Chinese, including operational steps and safety guidance. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy concern unless the locale limitation is explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The natural-language content forces a specific language/locale presentation for all users, and there is no indication that the skill is region-specific or that users can opt into Chinese. This matches the policy category for language or locale restrictions without user choice or documented justification.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The template explicitly instructs the agent to write analysis results and lessons into persistent memory files without any user-facing notice or confirmation. In an agent environment, this can cause unintended long-term retention of sensitive portfolio data, trading history, or behavioral notes, especially if the user did not realize state would be modified.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to update MEMORY.md adds another persistent write path, again without warning the user that durable records will be changed. Because this skill handles holdings, costs, stop-loss lines, and trading plans, silent persistence increases privacy and integrity risk if stale or sensitive data is stored or later reused.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The schedule configuration hard-codes
tz: "Asia/Shanghai", and the entire document is written as if this locale applies universally. Under the policy, forcing a specific locale without user opt-in or explicit justification can be a natural-language policy violation.- Content
Static analysis
No suspicious patterns detected.