Jquants Mcp

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:16 PM UTC
• Version: 0.1.2

Overview

The skill is a straightforward J-Quants market-data helper, with the main caution that it installs an unpinned third-party command that uses J-Quants credentials.

Before installing, confirm you trust the `jquants-mcp` package source and consider pinning a reviewed version. Use only the J-Quants credentials needed for this account, avoid exposing unrelated secrets in the same environment, and rotate the password if you suspect the installed package was compromised.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned Third-Party Package Receives Account Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4 and lines 76-78
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The skill installs the jquants-mcp package without pinning a version, verifying a package hash or signature, or identifying a specific audited source revision. The resulting executable runs in an environment containing the user's J-Quants email address and password.

Relevant code at line 4:

yaml

metadata: {"openclaw":{"emoji":"💹","requires":{"bins":["jquants-mcp"],"env":["JQUANTS_MAIL_ADDRESS","JQUANTS_PASSWORD"]},"install":[{"id":"uv","kind":"uv","package":"jquants-mcp","bins":["jquants-mcp"],"label":"Install jquants-mcp (uv)"}],"tags":["japan","stock","jpx","tse","price","ohlcv","finance","mcp","jquants"]}}

Relevant code at lines 76-78:

markdown

- Requires `JQUANTS_MAIL_ADDRESS` and `JQUANTS_PASSWORD` environment variables
- Free account registration: https://jpx-jquants.com/
- Python package: `pip install jquants-mcp` or `uv tool install jquants-mcp`

Technical Analysis

Both documented installation methods resolve the package without a fixed version or integrity constraint. Consequently, the code installed can change between installations even when the reviewed skill remains unchanged. No package source, lockfile, cryptographic hash, signature, or audited commit is included in the project.

The installed command requires access to JQUANTS_MAIL_ADDRESS and JQUANTS_PASSWORD. A malicious or compromised package release could read these environment variables during execution and transmit them externally. It could also execute arbitrary code with the permissions of the user invoking the command. The inspected project does not establish that the current package is malicious; the vulnerability is the uncontrolled supply-chain trust boundary and direct exposure of credentials to unverifiable dependency code.

Attack Path

1. An attacker c ...[truncated 1324 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin jquants-mcp to a specific, reviewed version rather than resolving the latest available release.
2. Verify the package using a cryptographic hash or trusted signature and maintain those integrity values in a lockfile or installation manifest.
3. Document the authoritative publisher and source repository, and reference a reviewed release or immutable commit.
4. Include auditable source code in the skill package where practical, or perform a separate security review of the exact dependency version before deployment.
5. Prefer a scoped, revocable API token over an account password if J-Quants supports one.
6. Execute the dependency in a restricted environment with only the required credentials, filesystem access, and network permissions.
7. Avoid exposing unrelated secrets through the process environment, and rotate the J-Quants password immediately if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Low

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to install jquants-mcp without pinning an exact version, which makes the installed code non-reproducible and exposes users to supply-chain risk if a later package release is compromised or introduces breaking behavior. In this context, the package is an executable MCP-related tool and the skill also requires credentials via environment variables, so an unsafe future version could access sensitive J-Quants account data or misuse the host environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.