ClawHub
Back to skill

Security audit

Tushare Cli

Security checks for vulnerabilities and agentic risk

Overview

This is a focused Tushare financial-data CLI with expected external API use and only minor disclosure and input-validation concerns.

Install only if you intend to use Tushare and are comfortable providing a TUSHARE_TOKEN for authenticated requests to Tushare. Prefer installing the tushare dependency from a pinned or trusted environment, and use normal stock-code formats rather than arbitrary pasted input.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Note
Location
scripts/tushare_cli.py:11
Finding

Unpinned Third-Party Dependency Installation Guidance

Content
View full analysis

Vulnerability Details

File Location: scripts/tushare_cli.py:11-16
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code

python
# 尝试导入 tushare
try:
    import tushare as ts
except ImportError:
    print("❌ 未安装 tushare，请运行：pip install tushare")
    sys.exit(1)

Technical Analysis

When the tushare module is unavailable, the program instructs users to execute pip install tushare without specifying a reviewed version, package hash, lock file, or trusted package index. The project also lacks a Python dependency manifest that constrains the package to a known version.

The CLI does not automatically execute the installation command, so exploitation requires a user or automation system to follow the displayed guidance. Nevertheless, installing an unconstrained package allows the selected artifact to change over time. A compromised future release, compromised package repository, or manipulated package index could therefore introduce malicious installation or runtime code.

Attack Path

  1. The CLI is executed in an environment where tushare is not installed.
  2. The import fails, and the CLI displays the unconstrained pip install tushare command.
  3. A user or deployment process follows that instruction.
  4. pip resolves the dependency from its configured package index without a version or hash constraint.
  5. If the selected package artifact or configured index is compromised, package installation or subsequent import executes attacker-controlled code.

Impact Assessment

Malicious package code would run with the privileges of the user performing the installation or invoking the CLI. Depending on those privileges, it could read accessible files and environment variables, including TUSHARE_TOKEN, alter user-owned files, establish network connections, or execute arbitrary commands. The scope is limited by the installing user's operating-system perm ...[truncated 59 chars]

Remediation
View remediation

Remediation Suggestions

  • Declare tushare in a dedicated dependency manifest and pin it to a reviewed version.
  • Generate a lock file or hash-verified requirements file, for example using pip-tools.
  • Require hashes during deployment with pip install --require-hashes -r requirements.txt.
  • Direct users to install dependencies from the reviewed manifest rather than displaying an unconstrained package installation command.
  • Use a trusted, explicitly configured package index in automated deployment environments.
  • Review and update pinned dependencies through a controlled dependency-update process.
  • Avoid installing dependencies with administrator or root privileges.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/tushare_cli.py:53
Finding

Terminal Escape-Sequence Injection Through Stock Code

Content
View full analysis

Vulnerability Details

File Location: scripts/tushare_cli.py:53-58
Vulnerability Type: Improper neutralization of terminal control characters
Risk Level: Low

Vulnerable Code

python
def query_basic(stock_code):
    """查询股票基本信息"""
    print_header(f"📈 股票基本信息 - {stock_code}")
    
    try:
        pro = get_pro()

Equivalent unsafe output occurs in the other stock-query handlers:

python
def query_indicators(stock_code):
    """查询财务指标"""
    print_header(f"📊 财务指标 - {stock_code}")
python
def query_daily(stock_code):
    """查询日线行情"""
    print_header(f"💹 日线行情 - {stock_code}")

The value originates from unrestricted command-line arguments:

python
basic_parser.add_argument('--stock', type=str, required=True, help='股票代码')
ind_parser.add_argument('--stock', type=str, required=True, help='股票代码')
daily_parser.add_argument('--stock', type=str, required=True, help='股票代码')

Technical Analysis

The --stock argument accepts an arbitrary string and is interpolated directly into terminal output. No syntax validation or removal of C0/C1 control characters occurs before the value reaches print_header().

On ANSI-compatible terminals, an attacker-controlled argument containing escape sequences can move the cursor, clear portions of the screen, change colors, overwrite previously displayed text, create misleading terminal content, or manipulate terminal titles. The exact behavior depends on the terminal emulator. This finding does not establish arbitrary shell-command execution because the value is not passed to a shell or command-execution API.

Attack Path

  1. An attacker supplies a crafted --stock value directly or causes another user or automation system to invoke the CLI with that value.
  2. The value contains terminal control bytes, such as an escape sequence that clears a line or repositions the cursor.
  3. argparse accepts the value beca ...[truncated 771 chars]
Remediation
View remediation

Remediation Suggestions

  • Validate stock codes before use with a strict allowlist pattern appropriate to supported exchanges, such as ^[0-9]{6}\.(SZ|SH|BJ)$.
  • Reject invalid values through a custom argparse type so unsafe input never reaches API or display functions.
  • As defense in depth, remove C0/C1 control characters and the escape character from any externally influenced terminal output.
  • Keep validation centralized and apply it consistently to all three --stock arguments.
  • Avoid relying only on shell quoting because terminal escape characters remain active after they reach standard output.
  • Add tests covering escape bytes, newlines, carriage returns, tabs, overlong values, and malformed exchange suffixes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares environment-variable requirements (TUSHARE_TOKEN) but does not define an explicit tool/permission scope. That creates ambiguity about what the skill is allowed to access and can lead to over-broad runtime privileges or unintended secret exposure in platforms that rely on manifest-declared scope for enforcement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The triggers include broad generic phrases like '股票数据', '财务数据', '行情数据', and '财经新闻', which are likely to match many unrelated user requests. This can cause accidental invocation of the skill in contexts where the user did not intend to use it, increasing the chance of unnecessary external API calls, token use, or data handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

All user-facing instructions and slogans in the README are presented only in Chinese, with no indication that another language is available or that the locale restriction is intentional and justified. The policy requires avoiding forced language/locale constraints unless users are given a choice or the limitation is clearly documented.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file documents the required TUSHARE_TOKEN environment variable and the skill's purpose is querying remote financial data, but it does not explicitly warn users that the tool will send requests to an external service using their credentials. For markdown files, user-facing warnings should mention behaviors that affect privacy or external data transmission.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description, author name, and tags are presented in Chinese, which may effectively force a specific language for users without any stated opt-in or documented locale constraint. Under the language/locale policy, this is a natural-language policy concern unless the skill explicitly offers a language choice or explains that it is intended only for a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

Natural-language strings such as the module description, help text, and runtime messages are presented only in Chinese. Under the policy, this is a locale/language constraint without an explicit opt-in or documented justification that the skill is region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

Reading an API token from an environment variable is a credential-handling operation. Although the script prints setup guidance when the variable is missing, it does not clearly disclose in its main interface that authenticated requests rely on a sensitive token being consumed and sent to the external Tushare service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This Python code makes outbound API calls via the Tushare client, which transmits the requested stock code to a third-party service. While the script states its purpose is querying market data, it does not explicitly warn the user that their query inputs are sent over the network to Tushare.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.