stock-tracker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:16 AM UTC
• Version: 2.2.0

Overview

This stock-announcement tracker is mostly purpose-aligned, but it needs review because it handles session cookies and API keys, can install recurring cron jobs, and exposes an unauthenticated dashboard beyond localhost.

Review before installing. Use a dedicated environment, protect cookie.txt and .env, avoid running scripts/setup.sh unless you explicitly want its cron entries, check your crontab after setup, and run the dashboard only on loopback or behind access controls. Be aware that LLM features send announcement titles/text to the configured model endpoint and may incur API costs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T06 · System Persistence

Error

• Location: scripts/setup.sh:103

Finding

Setup Script Unconditionally Installs Persistent Scheduled Tasks

Content

View full analysis

> $SKILL_DIR/logs/stock_tracker.log 2>&1" CRON_CMD_2="0 7 * * * cd $SKILL_DIR && $PYTHON $SCRIPT_DIR/stock_tracker.py --source cninfo --group 持仓 --days 15 --fetch-content >> $SKILL_DIR/logs/stock_tracker.log 2>&1" EXISTING=$(crontab -l 2>/dev/null || true) if echo "$EXISTING" | grep -qF "$SCRIPT_DIR/stock_tracker.py"; then echo " [OK] 定时任务已存在，跳过。如需更新请手动编辑 crontab。" else ( echo "$EXISTING" echo "# stock-tracker: 东方财富自选股公告追踪 (北京时间 9:00)" echo "$CRON_CMD_1" echo "# stock-tracker: 东方财富自选股公告追踪 (北京时间 15:00)" echo "$CRON_CMD_2" ) | crontab - ``` ### Technical Analysis Running the general setup script automatically modifies the invoking user's crontab and installs two recurring jobs. There is no command-line opt-in flag, interactive confirmation, dry-run mode, or choice to skip persistence. Scheduled execution is related to the Skill's advertised monitoring function, but it exceeds the minimum privileges needed for installation and one-time operation. Setup can install dependencies and prepare configuration without modifying persistent system state. Persistence should occur only after a distinct, informed scheduling request. The generated jobs repeatedly invoke `stock_tracker.py --fetch-content`. Depending on configuration and available credentials, this can perform network requests, process announcement data through an external LLM, write to the database, and append logs after the original Skill session has ended. ### Attack Path 1. A user or Agent runs `bash scripts/setup.sh` to initialize the Skill. 2. The script rea ...[truncated 970 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/dashboard.py:263

Finding

Unauthenticated Dashboard Is Exposed on All Network Interfaces

Content

View full analysis

") def api_announcements(stock_code): if not _RE_STOCK_CODE.match(stock_code): return jsonify({"error": "股票代码格式错误"}), 400 data = db.get_announcements_for_stock(stock_code, days=30) for item in data: item["title"] = html.escape(item.get("title") or "") item["summary"] = html.escape(item.get("summary") or "") item["clean_text"] = html.escape(item.get("clean_text") or "") item["ann_type_category"] = html.escape(item.get("ann_type_category") or "") item["ann_type_tag"] = html.escape(item.get("ann_type_tag") or "") return jsonify(data) @app.route("/api/export/csv") def export_csv(): data = db.get_all_valuable_announcements(days=30) output = io.StringIO() output.write('\ufeff') # BOM for Excel writer = csv.writer(output) writer.writerow(["股票代码", "股票名称", "公告标题", "公告日期", "大类", "小类", "摘要", "链接"]) for ann in data: writer.writerow([ ann["stock_code"], ann["stock_name"], ann["title"], ann["ann_date"], ann["ann_type_category"], ann["ann_type_tag"], ann["summary"], ann["url"], ]) return Response( output.getvalue(), mimetype="text/csv", headers={"Content-Disposition": f"attachment; filename=announcements_{datetime.now().strftime('%Y%m%d')}.csv"}, ) if __name__ == "__main__": db.init_db() port = int(os.environ.get("PORT" ...[truncated 2040 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/dashboard.py:210

Finding

Untrusted Announcement URLs Are Rendered Without Scheme or Host Validation

Content

View full analysis

'; html += `

${a.title}${tagHtml}

`; html += `

${a.ann_date}`; if (a.display_time_dfcf) html += ` (显示时间: ${a.display_time_dfcf})`; if (a.url) html += ` · 查看原文`; html += '

'; if (a.summary) { html += `

${a.summary}

`; } ``` ### Technical Analysis The URL is inserted into an `href` after replacing only double quotes. This does not validate its scheme or destination. In particular, it does not reject executable or unsafe schemes such as `javascript:` or unexpected attacker-controlled destinations. The URL originates from stored announcement data, which can be populated from remote API responses. If an upstream response, imported database record, or other data ingestion path supplies a malicious URL, the dashboard turns that value into a clickable link. The use of `target="_blank"` without `rel="noopener noreferrer"` also permits opener access in browser configurations where implicit opener isolation is not enforced. ### Attack Path 1. A malicious or compromised upstream data source supplies an announcement URL using an unsafe scheme or attacker-controlled destination. 2. The value is stored in the announcement database. 3. A user opens the dashboard and expands the affected stock. 4. Client-side code inserts the stored value directly into the anchor's `href`. 5. The user clicks the “original announcement” link. 6. The browser executes the unsafe URL behavior or opens attacker-controlled content; where opener access remains available, the destination can attempt to manipulate the d ...[truncated 596 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/setup.sh:23

Finding

Setup Installs Mutable Third-Party Dependencies Without Isolation or Integrity Pinning

Content

View full analysis

/dev/null; then pip3 install requests pdfplumber elif command -v pip &>/dev/null; then pip install requests pdfplumber else echo "错误: 未找到 pip/pip3，请先安装 Python 包管理器。" exit 1 fi # 可选安装 Playwright（Cookie 自动续签用） echo "" echo "[2/5] 安装 Playwright（可选，Cookie 自动续签用）..." if command -v pip3 &>/dev/null; then pip3 install playwright 2>/dev/null && python3 -m playwright install chromium 2>/dev/null && echo " [OK] Playwright 安装完成" || echo " [跳过] Playwright 未安装（不影响核心功能）" elif command -v pip &>/dev/null; then pip install playwright 2>/dev/null && python3 -m playwright install chromium 2>/dev/null && echo " [OK] Playwright 安装完成" || echo " [跳过] Playwright 未安装（不影响核心功能）" fi ``` The dependency declaration also accepts arbitrary later versions: ```text requests>=2.31.0 flask>=3.0.0 pdfplumber>=0.10.0 ``` ### Technical Analysis The setup script resolves package names to whatever compatible releases are available at installation time. It does not use a virtual environment, exact versions, hashes, a locked transitive dependency graph, or an explicitly configured trusted package index. It also describes Playwright as optional but attempts to install it automatically. Installing Playwright and Chromium adds a substantial executable browser component that is not needed for the core announcement-tracking path. No typosquatted or known-malicious package was identified in the reviewed declarations. The risk is that future dependency changes, repository compromise, resolver changes, or a compromised package-index configuration could introduce unreviewed code. Package installation and browser installation occur with the permissions of the user running setup. ### Attack Pat ...[truncated 1314 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (93)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 27)May include surrounding context.

3. 配置 LLM（可选）

bash

echo "LLM_API_KEY=sk-your-api-key" > .env

config.json 中配置模型地址等参数（默认使用 DeepSeek V4 Flash）。未配置时自动禁用 LLM，仅使用正则过滤。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 89)May include surrounding context.

3. 配置 LLM（可选）

bash

echo "LLM_API_KEY=sk-your-api-key" > .env

config.json 中配置模型地址等参数（默认使用 DeepSeek V4 Flash）。未配置时自动禁用 LLM，仅使用正则过滤。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 130)May include surrounding context.

3. 配置 LLM（可选）

bash

echo "LLM_API_KEY=sk-your-api-key" > .env

config.json 中配置模型地址等参数（默认使用 DeepSeek V4 Flash）。未配置时自动禁用 LLM，仅使用正则过滤。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/llm_judge.py (reported line 263)May include surrounding context.

python

### 3. 配置 LLM（可选）

```bash
echo "LLM_API_KEY=sk-your-api-key" > .env
```

`config.json` 中配置模型地址等参数（默认使用 DeepSeek V4 Flash）。未配置时自动禁用 LLM，仅使用正则过滤。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/llm_judge.py (reported line 281)May include surrounding context.

python

### 3. 配置 LLM（可选）

```bash
echo "LLM_API_KEY=sk-your-api-key" > .env
```

`config.json` 中配置模型地址等参数（默认使用 DeepSeek V4 Flash）。未配置时自动禁用 LLM，仅使用正则过滤。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/reclassify_all.py (reported line 94)May include surrounding context.

python

### 3. 配置 LLM（可选）

```bash
echo "LLM_API_KEY=sk-your-api-key" > .env
```

`config.json` 中配置模型地址等参数（默认使用 DeepSeek V4 Flash）。未配置时自动禁用 LLM，仅使用正则过滤。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 69)May include surrounding context.

sh

### 3. 配置 LLM（可选）

```bash
echo "LLM_API_KEY=sk-your-api-key" > .env
```

`config.json` 中配置模型地址等参数（默认使用 DeepSeek V4 Flash）。未配置时自动禁用 LLM，仅使用正则过滤。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 75)May include surrounding context.

sh

### 3. 配置 LLM（可选）

```bash
echo "LLM_API_KEY=sk-your-api-key" > .env
```

`config.json` 中配置模型地址等参数（默认使用 DeepSeek V4 Flash）。未配置时自动禁用 LLM，仅使用正则过滤。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 132)May include surrounding context.

sh

### 3. 配置 LLM（可选）

```bash
echo "LLM_API_KEY=sk-your-api-key" > .env
```

`config.json` 中配置模型地址等参数（默认使用 DeepSeek V4 Flash）。未配置时自动禁用 LLM，仅使用正则过滤。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill documentation explicitly instructs users to install Playwright and run a cookie refresh script that automates browser login/session renewal and writes updated cookies to a local credential file. That introduces credential-handling and session-token management behavior beyond simple announcement tracking, and if mishandled can expose authenticated Eastmoney sessions or enable account misuse.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill documentation explicitly instructs users to install Playwright and run a cookie refresh script that automates browser login/session renewal and writes updated cookies to a local credential file. That introduces credential-handling and session-token management behavior beyond simple announcement tracking, and if mishandled can expose authenticated Eastmoney sessions or enable account misuse.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill documentation explicitly instructs users to install Playwright and run a cookie refresh script that automates browser login/session renewal and writes updated cookies to a local credential file. That introduces credential-handling and session-token management behavior beyond simple announcement tracking, and if mishandled can expose authenticated Eastmoney sessions or enable account misuse.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill documentation explicitly instructs users to install Playwright and run a cookie refresh script that automates browser login/session renewal and writes updated cookies to a local credential file. That introduces credential-handling and session-token management behavior beyond simple announcement tracking, and if mishandled can expose authenticated Eastmoney sessions or enable account misuse.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill documentation explicitly instructs users to install Playwright and run a cookie refresh script that automates browser login/session renewal and writes updated cookies to a local credential file. That introduces credential-handling and session-token management behavior beyond simple announcement tracking, and if mishandled can expose authenticated Eastmoney sessions or enable account misuse.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill documentation explicitly instructs users to install Playwright and run a cookie refresh script that automates browser login/session renewal and writes updated cookies to a local credential file. That introduces credential-handling and session-token management behavior beyond simple announcement tracking, and if mishandled can expose authenticated Eastmoney sessions or enable account misuse.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill documentation explicitly instructs users to install Playwright and run a cookie refresh script that automates browser login/session renewal and writes updated cookies to a local credential file. That introduces credential-handling and session-token management behavior beyond simple announcement tracking, and if mishandled can expose authenticated Eastmoney sessions or enable account misuse.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill documentation explicitly instructs users to install Playwright and run a cookie refresh script that automates browser login/session renewal and writes updated cookies to a local credential file. That introduces credential-handling and session-token management behavior beyond simple announcement tracking, and if mishandled can expose authenticated Eastmoney sessions or enable account misuse.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill documentation explicitly instructs users to install Playwright and run a cookie refresh script that automates browser login/session renewal and writes updated cookies to a local credential file. That introduces credential-handling and session-token management behavior beyond simple announcement tracking, and if mishandled can expose authenticated Eastmoney sessions or enable account misuse.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill documentation explicitly instructs users to install Playwright and run a cookie refresh script that automates browser login/session renewal and writes updated cookies to a local credential file. That introduces credential-handling and session-token management behavior beyond simple announcement tracking, and if mishandled can expose authenticated Eastmoney sessions or enable account misuse.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

The skill directly instructs creation of a .env file containing an LLM API key, which is a credential-access pattern because it normalizes handling a live secret in plaintext within the skill directory. In the context of an agent skill with file access, that increases the chance of unintended disclosure to other tools, users, backups, or version control.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

LLM 用于标题价值判断、公告分类和摘要生成。未配置时仅使用正则过滤。

bash

# .env 文件
echo "LLM_API_KEY=sk-your-api-key" > .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

This is the same credential-handling issue manifested in the adjacent .env instruction: the documentation encourages storing an API secret in plaintext in a local file. In a skill that also performs network operations and local file access, that context makes secret exposure more dangerous because the key could be reused for unauthorized API consumption or data access.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

bash

# .env 文件
echo "LLM_API_KEY=sk-your-api-key" > .env

json

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config_manager.py (reported line 100)May include surrounding context.

python

fi

# .env（LLM API Key）
if [ ! -f "$SKILL_DIR/.env" ]; then
    echo "  [提示] .env 不存在，正在创建空白模板..."
    echo "# Stock Tracker LLM 配置" > "$SKILL_DIR/.env"
    echo "# 从 https://platform.openai.com/api-keys 获取" >> "$SKILL_DIR/.env"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 68)May include surrounding context.

sh

fi

# .env（LLM API Key）
if [ ! -f "$SKILL_DIR/.env" ]; then
    echo "  [提示] .env 不存在，正在创建空白模板..."
    echo "# Stock Tracker LLM 配置" > "$SKILL_DIR/.env"
    echo "# 从 https://platform.openai.com/api-keys 获取" >> "$SKILL_DIR/.env"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 70)May include surrounding context.

sh

fi

# .env（LLM API Key）
if [ ! -f "$SKILL_DIR/.env" ]; then
    echo "  [提示] .env 不存在，正在创建空白模板..."
    echo "# Stock Tracker LLM 配置" > "$SKILL_DIR/.env"
    echo "# 从 https://platform.openai.com/api-keys 获取" >> "$SKILL_DIR/.env"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 71)May include surrounding context.

sh

fi

# .env（LLM API Key）
if [ ! -f "$SKILL_DIR/.env" ]; then
    echo "  [提示] .env 不存在，正在创建空白模板..."
    echo "# Stock Tracker LLM 配置" > "$SKILL_DIR/.env"
    echo "# 从 https://platform.openai.com/api-keys 获取" >> "$SKILL_DIR/.env"

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: README.md:133

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: tests/test_config_manager.py:166