T08 · Insecure Dependencies
Warning
- Location
references/akshare-interfaces.md:12- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
A股信号
Security checks for vulnerabilities and agentic risk
Overview
This A-share analysis skill is coherent and disclosed, with optional market-data fallback behavior that should be used only with user consent.
Before using the optional AkShare/BaoShare fallback, confirm you trust those data-source packages and install them in an isolated environment with pinned versions if possible. Treat outputs as research and not investment advice, and verify financial conclusions against authoritative market data.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个面向投资分析的技能，核心能力应是对A股进行多框架技术分析并生成结论。实际代码仅提供数据拉取与查询：调用 AkShare 获取行情、K线、板块、资金流，并支持按名称/代码搜索股票，输出的是原始记录 JSON。两者主目的明显不同：一个是“分析与结论生成”，另一个是“数据获取工具”。此外，代码还依赖外部数据源 AkShare，这一实际资源访问能力也未在声明中体现。因此属于明显的描述与行为不一致。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The README presents the skill entirely in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The display name, description, and default prompt are all exclusively in Chinese, which indicates the skill is designed to operate in a fixed language without any visible opt-in or alternative locale. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is clearly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The entire skill reference is written as Chinese-only operational guidance, including headings and usage instructions, with no indication that users may choose another language or that the locale restriction is intentional for a region-specific workflow. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown skill reference presents all instructions and constraints exclusively in Chinese, with no indication that the user can choose another language or locale. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The title and all operational instructions are written as a Chinese-only routing reference, and the file does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The entire reference is written as Chinese-only operational guidance, and there is no indication that users may request another language or that the locale restriction is intentional for a China-specific audience. Under the policy, a skill should not implicitly force a specific language without opt-in or clear justification.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file explicitly states that the AkShare-based fallback should only be used after explicit user consent, but the code does not enforce that requirement anywhere. In an agent setting, this can cause unauthorized use of a non-approved external data source, violating user expectations, platform policy, or data-governance controls.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring and all user-facing strings are written only in Chinese, indicating the skill is designed to operate in a single language with no opt-in or alternative locale. Under the policy, language constraints should either offer user choice or be clearly justified as region-specific beyond the market scope alone.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest describes a skill that analyzes A-shares using frameworks like chip distribution, three-cycle resonance, optimized KDJ, Wyckoff, Chan theory, and custom scoring rules to produce structured conclusions and risk prompts. This file only fetches and prints market quotes, K-lines, sector data, fund flow, and search results via AkShare, with no implementation of those analysis frameworks or any structured conclusion generation.
- Content
Static analysis
No suspicious patterns detected.