Ashareskill

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 7:25 AM UTC
• Version: 0.1.0

Overview

This skill is a stock-data retrieval tool whose network use and CSV output match its stated purpose, with ordinary dependency hygiene caveats.

Install this in a dedicated virtual environment and review or pin dependency versions if you need reproducible deployments. Expect it to contact BaoStock for market data and to write CSV files when you run export examples or provide an output path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Unverified Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-3
Vulnerability Type: Supply-chain exposure through unbounded dependencies without integrity verification
Risk Level: Medium

Complete Code Snippet:

text

baostock>=0.8.8
pandas>=1.3.0
numpy>=1.21.0

The documented installation procedure in README.md:33-37 and README.md:197-199 instructs users to install these dependencies directly:

bash

pip install -r requirements.txt

Technical Analysis

All dependencies specify only minimum versions using >=. Consequently, future releases remain valid installation candidates, even though they were not available for review when the Skill was audited. The project also provides no lock file or cryptographic hashes to authenticate the exact distribution artifacts being installed.

Dependency installation and subsequent imports execute third-party code. If an accepted package release, configured package index, or distribution artifact is compromised, the application can install and execute code that is outside the audited project. This risk applies particularly to fresh installations and dependency upgrades.

No evidence was found that the project intentionally references a typosquatted package or untrusted package repository. The finding concerns the absence of version reproducibility and artifact-integrity controls.

Attack Path

1. An attacker compromises a future release of one of the listed packages, its publishing account, a configured package index, or the artifact delivery path.
2. The malicious release retains a version satisfying the project's lower-bound constraint.
3. A user follows the documented command pip install -r requirements.txt.
4. The package resolver selects the compromised release because no exact version or trusted hash restricts it.
5. Malicious dependency code executes during installation or when baostock, pandas, or numpy is imported by `scripts/ ...[truncated 815 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace lower-bound-only constraints with exact versions that have been reviewed and tested, for example package==x.y.z.
2. Generate a reproducible lock file containing cryptographic hashes for all direct and transitive dependencies.
3. Require hash verification during installation, such as:

   bash

   pip install --require-hashes -r requirements.txt
   

4. Regenerate and review the lock file through a controlled dependency-update process rather than resolving arbitrary new releases during deployment.
5. Configure installations to use an approved package index or an internally controlled artifact mirror.
6. Run dependency vulnerability and provenance checks in continuous integration.
7. Install and execute the Skill in a dedicated, least-privileged virtual environment or container, and avoid administrator-level installation.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency specifier baostock>=0.8.8 is unpinned, so future installations may resolve to different package versions over time. This creates supply-chain and reproducibility risk because a later compromised or breaking release could be pulled into the environment without review.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

baostock>=0.8.8
pandas>=1.3.0
numpy>=1.21.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency pandas>=1.3.0 is not pinned to a specific version, which means builds are not reproducible and may silently install newer releases. In a security context, this increases supply-chain exposure because an unsafe or vulnerable upstream version could be introduced later without any change to this repository.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

baostock>=0.8.8
pandas>=1.3.0
numpy>=1.21.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Using numpy>=1.21.0 allows any later version to be installed, which weakens build determinism and expands the attack surface of the dependency chain. If a future release contains a security flaw or malicious package compromise, deployments could ingest it automatically.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

baostock>=0.8.8
pandas>=1.3.0
numpy>=1.21.0

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring presents the skill description entirely in Chinese, and the rest of the user-facing messages in the file follow the same pattern. This can violate a language/locale policy when a skill effectively forces one language without user opt-in or an explicit justification that it is region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest primarily describes using BaoStock to query K-line and indicator data, while the implementation includes a file-writing capability that persists results to user-specified paths. Although exporting is mentioned in the description, this is still a broader operational behavior than pure retrieval and introduces local side effects.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.