A-Stock Kline Analyzer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:19 AM UTC
• Version: 1.0.3

Overview

This A-share analyzer mostly matches its stated purpose, but its system-level install guidance and documentation mismatches warrant review before use.

Install only in a virtual environment, avoid the documented --break-system-packages command, review/pin dependencies including requests, and treat generated trading suggestions as educational analysis rather than financial advice. Be aware that some advertised features may not work as documented.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:54
• Finding: Unpinned dependencies installed while bypassing system package protections<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:54` **Vulnerability Type**: Unsafe and unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash pip3 install baostock pandas matplotlib --break-system-packages ``` ### Technical Analysis The documented installation command installs third-party packages without version constraints or integrity hashes. Consequently, future installations may retrieve dependency versions that differ from those reviewed during this audit. The `--break-system-packages` option disables the externally managed environment protection used by many Python distributions. This can allow pip to modify an operating-system-managed Python environment, subject to the invoking user's filesystem permissions. Such modifications may replace or conflict with packages required by other applications. The application also directly imports `requests` in `scripts/kline_analyzer.py`, but this package is not explicitly listed in the installation command. Relying on undeclared transitive or preinstalled dependencies makes the effective dependency set difficult to reproduce and audit. This condition does not prove that any current dependency is malicious. It creates supply-chain exposure because a compromised or unexpectedly changed package release could be installed without a reviewed lock file or hash verification. ### Attack Path 1. An attacker compromises a configured package index, a dependency publisher account, or a future dependency release. 2. The victim follows the installation command from `SKILL.md`. 3. Pip resolves the unconstrained package name to the attacker-controlled or compromised release. 4. Malicious build or installation logic executes during package processing, or malicious package code executes when the application imports the dependency. 5. The payload obtains the privileges of the user running pip or the analyzer. 6. If the user invokes the command with elevated privileges, ...[truncated 640 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create and use an isolated virtual environment rather than modifying the operating-system-managed interpreter: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --upgrade pip python3 -m pip install -r requirements.txt ``` 2. Remove `--break-system-packages` from the documented installation procedure. 3. Declare every direct dependency, including `requests`. 4. Pin reviewed versions in a lock file or requirements file. 5. Generate and verify cryptographic hashes, for example with `pip-compile --generate-hashes`, and install with `--require-hashes`. 6. Review transitive dependencies and update them through a controlled process. 7. Configure pip to use trusted HTTPS package indexes and avoid unreviewed extra indexes. 8. Run dependency vulnerability scanning in CI and test updates before release. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: batch_analyze.py:5
• Finding: Current working directory is given priority during Python module resolution<![CDATA[ ## Vulnerability Details **File Location**: `batch_analyze.py:5-7` **Vulnerability Type**: Python module search-path manipulation enabling local module shadowing **Risk Level**: Medium ### Vulnerable Code ```python import sys sys.path.insert(0, '.') from scripts.kline_analyzer import analyze_stock ``` ### Technical Analysis The code explicitly inserts `.` at the beginning of `sys.path`. The meaning of `.` is the process's current working directory, which may differ from the directory containing `batch_analyze.py`. Because the current working directory receives the highest import priority, an attacker who can place files in the directory from which the program is launched can create a counterfeit `scripts/kline_analyzer.py`. Python may then import and execute that file instead of the intended project module. Python executes top-level module code during import, so the counterfeit module does not need to provide a functional analyzer before gaining code execution. It can perform malicious actions and then define `analyze_stock` to avoid an immediate import error. The audited `scripts/kline_analyzer.py` also does not define the imported `analyze_stock` function. That is a separate correctness defect that causes the legitimate batch launcher to fail, but it is not by itself the security vulnerability described here. ### Attack Path 1. A victim launches `batch_analyze.py` while the current working directory is attacker-controlled or contains attacker-supplied files. 2. The attacker creates the following path in that directory: ```text scripts/kline_analyzer.py ``` 3. The counterfeit module contains malicious top-level Python code and optionally defines an `analyze_stock` function. 4. `sys.path.insert(0, '.')` places the attacker-controlled directory before the legitimate project path. 5. The import statement resolves to the counterfeit module. 6. Python executes the attacker's top-level code under the identity and privileges of the user running ...[truncated 534 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the current-directory path insertion: ```python sys.path.insert(0, '.') ``` 2. Package the project as a proper Python package and use normal package imports from a controlled installation. 3. If direct script execution must be supported, resolve the project directory from `__file__` rather than from the current working directory: ```python from pathlib import Path import sys PROJECT_ROOT = Path(__file__).resolve().parent sys.path.insert(0, str(PROJECT_ROOT)) ``` 4. Prefer an installed console entry point so manual `sys.path` modification is unnecessary. 5. Add `scripts/__init__.py` where appropriate and define a clear package boundary. 6. Implement the expected `analyze_stock` function or change the import to an API that actually exists. 7. Add a test that launches the batch script from a different working directory and confirms that the imported module originates from the trusted project path. 8. Avoid running the analyzer from directories writable by untrusted users and do not execute it with elevated privileges. ]]>

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The metadata and documentation overclaim functionality and version state, including v1.0.6 features that static analysis indicates are only partially implemented and a version mismatch with the underlying code. In security terms, misleading capability claims reduce operator trustworthiness checks and can cause users to rely on analyses, outputs, or data provenance that the skill does not actually provide, which is especially risky for a networked financial-analysis tool.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises live quote retrieval from Sina Finance and historical data retrieval from Baostock, which implies outbound network access, but it does not declare any explicit tool scope or permissions. This creates an authorization and review gap: operators and users cannot easily see or constrain what external connectivity the skill requires, increasing the risk of unintended data egress or broader-than-necessary network use.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The skill name, description, and all user-facing documentation are entirely in Chinese and specifically position the tool as an A-share analyzer, but there is no indication that language is configurable or that Chinese-only operation is an explicit user choice. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The HTTP header hard-codes `Accept-Language: zh-CN,zh;q=0.9`, which enforces a specific language/locale preference in network requests. The file does not offer a user choice or document this locale restriction as an explicit, justified regional constraint.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: This Python file contains natural-language strings exclusively in Chinese, including the module docstring and console output, with no indication that the skill is region-specific or that users can select another language. That creates a language/locale policy issue under the stated rule because the skill implicitly forces a specific language without opt-in.

Static analysis

No suspicious patterns detected.