akshare

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:20 AM UTC
• Version: 0.1.1

Overview

This skill is a disclosed AKShare finance-data guide, with ordinary dependency and language-scope cautions but no hidden, destructive, or persistence behavior.

Install this only if you want AKShare-based market-data help. Use a virtual environment, avoid elevated privileges, consider pinning reviewed package versions, and verify finance data independently before making investment decisions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

bash

pip install akshare pandas

Technical Analysis

The installation command retrieves the latest available versions of akshare, pandas, and their transitive dependencies. The project does not specify reviewed versions, package hashes, a dependency lockfile, an isolated environment, or an explicit trusted package index.

Consequently, the installed code may change between executions and is not represented within the audited project. Python packages can execute code during installation or when imported. If a package release or transitive dependency is compromised, replaced, or unexpectedly changed, following this instruction could introduce unreviewed executable code into the user's environment.

Attack Path

1. An attacker compromises a listed package, one of its transitive dependencies, or the package-distribution channel.
2. The attacker publishes a malicious or modified release under a version accepted by the unpinned installation command.
3. A user follows the documented instruction and runs pip install akshare pandas.
4. pip resolves and downloads the attacker-controlled release because no versions or hashes constrain dependency resolution.
5. Malicious code executes during package installation or later when the package is imported.

Impact Assessment

A compromised dependency could execute with the privileges of the user running pip or Python. Potential impact includes access to files and environment variables available to that user, modification of the Python environment, arbitrary network communication, and execution of additional commands.

The scope normally remains limited to the invoking user's permissions. If installation is performed as an administrator or with elevated privileges, the impact could extend to system-wide P ...[truncated 45 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed, exact version.

2. Generate a lockfile that also constrains all transitive dependencies.

3. Record and verify cryptographic hashes for every downloaded distribution.

4. Install dependencies in a dedicated virtual environment rather than globally or with elevated privileges.

5. Explicitly configure the intended trusted package index and disable unintended fallback indexes.

6. Regularly scan pinned dependencies for known vulnerabilities and review updates before changing the lockfile.

7. Replace the mutable command with a hash-verified installation workflow, such as:

   bash

   python -m venv .venv
   . .venv/bin/activate
   python -m pip install --require-hashes -r requirements.txt
   

The referenced requirements.txt should contain exact versions and approved hashes for both direct and transitive dependencies.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger description is very broad, listing many generic finance-related phrases in both English and Chinese. This can cause the skill to activate in contexts where the user did not specifically request AKShare, increasing the chance of unintended tool use, unnecessary network access, and off-topic responses in a sensitive financial domain.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The title and the surrounding instructional content are written entirely in Chinese, which implies a fixed language/locale for the skill experience. There is no statement that the skill is China-specific in language output only, nor any indication that users may choose another language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file presents all headings and descriptions in Chinese and does not indicate that the skill is China-specific or that users may choose another language. Under the natural-language policy, forcing a specific language without user opt-in can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.