Stockaskill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 0.1.0

Overview

This stock-analysis skill is coherent, but it asks the agent to run broad local Python/Bash workflows and install mutable market-data packages while the referenced scripts are not included for review.

Install only if you are comfortable with a stock-research skill that may fetch market data from external providers, create local cache/report files, and ask to install Python packages. Use a disposable virtual environment, avoid running it in a sensitive workspace, review or supply the missing scripts yourself, and prefer pinned dependency versions before allowing installs or upgrades.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:186

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:186
Additional Location: references/akshare_official_docs.md:35-41
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Complete Code Snippets

From SKILL.md:

markdown

| `import akshare` fails | Not installed | `pip install akshare efinance baostock` |

From references/akshare_official_docs.md:

bash

# Install
pip install akshare

# Upgrade to the latest version
pip install akshare --upgrade

Technical Analysis

The Skill recommends installing akshare, efinance, and baostock directly from the package index without exact version constraints, cryptographic hashes, a reviewed lockfile, or an isolated-environment requirement. It also recommends unrestricted upgrades of akshare.

Package versions resolved by these commands can change after the Skill has been reviewed. Consequently, the effective code installed and later imported is not reproducible. A compromised maintainer account, malicious package release, package-index compromise, or unexpected upstream change could introduce arbitrary code into the runtime.

Although the package names do not appear to be deliberate typos in the reviewed material, the installation guidance lacks provenance information for efinance and baostock. The project also provides no dependency manifest against which package identity and integrity can be verified.

Attack Path

1. The Agent activates the Skill for a stock-analysis request.
2. A required import fails because a market-data dependency is unavailable.
3. The Agent follows SKILL.md:186 or the AKShare setup reference.
4. pip resolves the mutable latest package releases from its configured index.
5. An attacker-controlled or compromised release is downloaded and installed.
6. Package installation hooks or subsequent imports execute attacker-supplied Python code with the privileges of the Agent process.
7. That code can access resou ...[truncated 697 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a reviewed dependency manifest with exact versions, such as:

   text

   akshare==REVIEWED_VERSION --hash=sha256:REVIEWED_HASH
   efinance==REVIEWED_VERSION --hash=sha256:REVIEWED_HASH
   baostock==REVIEWED_VERSION --hash=sha256:REVIEWED_HASH
   

2. Generate and commit a lockfile containing hashes for direct and transitive dependencies.

3. Replace direct pip install examples with hash-enforced installation:

   bash

   python -m pip install --require-hashes -r requirements.lock
   

4. Remove pip install akshare --upgrade; upgrades should occur only through a reviewed dependency-update process.

5. Document the official package project and repository for every dependency so users can verify provenance.

6. Install dependencies in a dedicated virtual environment or disposable container rather than the Agent's global environment.

7. Run package installation and market-data processing as an unprivileged user with restricted filesystem and network access.

8. Scan dependency releases and transitive dependencies before updating the lockfile.

9. Include the referenced scripts/ implementation in the reviewed artifact so its dependency use and runtime behavior can be verified.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

python scripts/run.py fetch fundamentals 600519 # single stock fundamentals

text

## Output guidelines

### Terminal output (auto-detected):

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill declares network access and repeatedly instructs data refresh/fetch operations against third-party providers, but it does not clearly warn users that external requests will be made and market identifiers may be transmitted. This can expose usage patterns and query content to outside services and may violate user expectations in restricted environments.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger list includes broad, common terms such as "analysis," "portfolio," "fund," and "ETF," which can cause the skill to activate in contexts the user did not intend. Unintended activation can lead to unnecessary tool use, network access, or file writes in response to ordinary conversation, increasing the chance of privacy-impacting or surprising side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs writing diagnosis output into ./reports without a clear upfront warning or user confirmation. This creates a filesystem side effect that may surprise users, overwrite data, or persist potentially sensitive financial analysis locally without consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file says the variant is used when the user mentions "enhanced" or "core-satellite" strategy, but these triggers are not scoped to a specific command, workflow, or negative examples. This makes invocation conditions ambiguous and could cause unintended activation from ordinary discussion of investment strategies.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The ETF names are presented only in Chinese, which may impose a language/locale assumption on users without offering an alternative or stating that the skill is intended only for a Chinese-market context. Under the policy, locale-specific content should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file directs the agent to use Chinese by default for a portion of responses without tying that choice to the user's explicit language preference. This can cause unintended language switching, reduce transparency, and create a poor or exclusionary user experience, especially when the user asked in another language. In this stock-analysis context, the issue is not directly dangerous, but it can still undermine usability and trust.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction says to use the file when the user wants "conversation, coaching, or idea stress testing," which are very broad categories that overlap with many ordinary interactions. It does not define boundaries, specific trigger phrases, or exclusion conditions, so the skill could be invoked in unintended situations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file includes a required Chinese rendering under "In Chinese" without stating that the user requested Chinese or that language choice is optional. This can violate language/locale policy by imposing a specific language output path absent explicit user preference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This section again prescribes a Chinese version of the response with no instruction to confirm the user's preferred language first. Requiring a specific language output without opt-in is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The language guidance says to use Chinese for A-share content unless the user writes in English, and English for US/HK. This sets locale behavior based on market category rather than clearly offering the user an explicit language preference for all cases, which can violate language-choice policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file is written entirely in Chinese and presents the skill documentation only in that language, with no indication that users may choose another language or that the locale restriction is required. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. The A-shares section requires use of Chinese-language sources and labels, but the document does not provide user opt-in, alternatives, or a note that this locale-specific workflow is limited to users who can work in Chinese.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The markdown includes source names in Chinese script ("沪股通/深股通" and "East Money 股吧") without providing an English equivalent or indicating that Chinese terminology is optional. This can create a language/locale constraint in the skill documentation without user choice, which falls under the natural-language locale policy concerns for all file types.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file includes Chinese instrument names ("沪深300", "创业板", "科创50") in otherwise English documentation, but does not indicate that the user can choose language or locale. That can violate the language/locale policy because the skill presents a specific locale without opt-in or justification.

Content

No source excerpt is available for this finding.