Eastmoney Trading

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:00 AM UTC
• Version: 3.2.0

Overview

This skill is a disclosed Eastmoney trading automation tool, but it ships sensitive portfolio records and has weak safeguards around real-money trading actions.

Install only if you are comfortable granting this skill access to a real brokerage account and browser session. Remove the bundled logs before distribution, avoid remote CDP for trading, do not enable LLM captcha OCR unless you accept sending captcha images to a third party, keep logs/screenshots protected and cleaned up, and do not use --confirm or unattended trading until the order-confirmation and result-verification logic is strengthened.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: logs/2026-03-14/analysis_221448.json:1

Finding

Sensitive Portfolio Records Included in the Distributed Skill

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/eastmoney_trading.py:727

Finding

Portfolio Security Identifiers Transmitted over Plaintext HTTP

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/eastmoney_trading.py:1048

Finding

Real-Money Order Safeguards Can Be Bypassed and Ambiguous Results Are Reported as Success

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Unbounded Third-Party Dependency Versions

Content

View full analysis

=1.40.0 Pillow>=10.0.0 pytesseract>=0.3.10 requests>=2.31.0 pandas>=2.0.0 ``` The documented installation command directly resolves these requirements: ```bash pip install -r scripts/requirements.txt ``` ### Technical Analysis Every dependency uses only a lower version bound. As a result, future installations can resolve to versions that did not exist when the Skill was audited. No lock file or package hashes are provided. This prevents reproducible builds and expands supply-chain exposure. A compromised future package release, malicious dependency update, or incompatible behavior change could be installed without any modification to the Skill repository. No typosquatted or currently known malicious package was identified from the audited files. The issue is the unsafe dependency resolution policy rather than proof that the listed packages are malicious. ### Attack Path 1. A user follows the documented installation procedure. 2. `pip` resolves the newest versions satisfying the unbounded minimum constraints. 3. A future compromised or otherwise unsafe release satisfies those constraints. 4. The package is downloaded and installed without hash verification. 5. Package installation or later import executes with the privileges of the user running the Skill. 6. Because the Skill handles brokerage credentials and an authenticated browser session, malicious dependency code could access highly sensitive runtime data. ### Impact Assessment A successfully compromised dependency would execute with the operating-system privileges of the installing or running user. In this context, that could expose environment variables, local files, browser-session access, brokerage credentials entered into the page, and generat ...[truncated 171 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Tainted flow: 'req' from os.environ.get (line 233, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

The captcha OCR routine base64-encodes the login captcha image and sends it to an external LLM service using an API key from environment variables. Although the taint rule frames this as env-to-network flow, the real issue is exfiltration of authentication material to a third party without strong consent or minimization; in a trading skill, even captcha images are part of the login challenge and may expose account-login context to an outside service.

Content

Scanner excerpt · scripts/eastmoney_trading.py (reported line 240)May include surrounding context.

python

logger.info("正在调用大模型识别验证码...")
        
        with urllib.request.urlopen(req, timeout=30) as response:
            result = json.loads(response.read().decode('utf-8'))
            content = None

Tainted flow: 'version_url' from os.environ.get (line 378, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The code accepts EASTMONEY_CDP_URL from the environment and performs a request to its /json/version endpoint, then connects to the returned debugger WebSocket. If an attacker can influence this variable, the skill will connect to an arbitrary remote Chrome DevTools endpoint, granting that endpoint broad visibility and control over browser pages, cookies, session state, screenshots, and trading actions.

Content

Scanner excerpt · scripts/eastmoney_trading.py (reported line 379)May include surrounding context.

python

ws_url = None
    try:
        version_url = cdp_url.rstrip('/') + '/json/version'
        with urllib.request.urlopen(version_url, timeout=5) as resp:
            version_data = json.loads(resp.read().decode())
            ws_url = version_data.get('webSocketDebuggerUrl', '')
            ws_url = ws_url.replace('ws://127.0.0.1/', f'ws://{host}:9222/')

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The README documents use of a local .env file containing brokerage account credentials and also states that logs and screenshots are captured automatically. In a high-risk trading skill, this increases the chance that secrets or sensitive financial data are stored locally, exposed through screenshots/logs, or accidentally committed to version control, enabling account takeover or privacy loss.

Content

Scanner excerpt · README.md (reported line 120)May include surrounding context.

md

eastmoney-trading/
├── SKILL.md                      # Skill 说明文档
├── README.md                     # 本文件
├── .env                          # 账号密码（不要提交到 git）
├── logs/                         # 日志和截图（按天切分）
│   └── YYYY-MM-DD/
│       ├── eastmoney_trading_HHMMSS.log

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

pip3 install -r scripts/requirements.txt

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/eastmoney_trading.py (reported line 180)May include surrounding context.

python

password = os.environ.get("EASTMONEY_PASSWORD", "")
    
    if not account or not password:
        env_file = SKILL_DIR / '.env'
        if env_file.exists():
            logger.info(f"从 .env 文件加载配置...")
            try:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/eastmoney_trading.py (reported line 182)May include surrounding context.

python

if not account or not password:
        env_file = SKILL_DIR / '.env'
        if env_file.exists():
            logger.info(f"从 .env 文件加载配置...")
            try:
                with open(env_file, 'r') as f:
                    for line in f:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The entire skill documentation and command guidance are presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a specific locale for compliance reasons. Under the policy rule, a language or locale constraint should either be optional for the user or explicitly justified.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill requests sensitive capabilities in practice—environment variable access, file read/write, and network/browser connectivity—but does not declare any explicit tool scope or permissions boundaries. In a trading skill that handles brokerage credentials, screenshots, logs, and live transaction actions, this omission weakens reviewability and least-privilege controls, making unintended or excessive access harder to detect and restrict.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

3. 安装 Tesseract OCR（验证码识别）

bash

sudo apt-get install tesseract-ocr tesseract-ocr-chi-sim tesseract-ocr-eng

4. 配置账号密码

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 385)May include surrounding context.

3. 安装 Tesseract OCR（验证码识别）

bash

sudo apt-get install tesseract-ocr tesseract-ocr-chi-sim tesseract-ocr-eng

4. 配置账号密码

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The JSON contains user-facing suggestion strings entirely in Chinese, indicating the skill presents output in a fixed language. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This JSON file includes natural-language suggestions exclusively in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Per the policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The JSON includes natural-language suggestion strings only in Chinese across L110-L119. For a general analysis artifact, this imposes a specific language/locale on users without any visible opt-in, alternative, or documented regional limitation, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Captcha images are transmitted to an external OCR/LLM provider during a brokerage login flow without an explicit just-in-time disclosure or confirmation. In this context, the skill handles live securities accounts and real-money trading, so third-party transfer of login challenge material is especially sensitive and increases privacy, compliance, and account-takeover risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description says it supports 条件选股 as a functional capability. However, cmd_select merely navigates to the screening site, saves a screenshot, and prints guidance text; it never applies the CLI condition arguments or invokes the extraction logic to produce actual screening output.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The docstring actively states that the command uses 东方财富 conditions and supports technical, fundamental, market, and sector filters. In reality, the function ignores args.condition, args.market, args.industry, and args.concept and only opens the homepage and prints advice, which contradicts the stated behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This JSON file contains user-facing suggestion strings entirely in Chinese, with no indication that the user can choose another language or that the locale is intentionally constrained. Under the policy, hard-coded language output without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The JSON contains user-facing suggestion strings entirely in Chinese, which imposes a specific language on the user. Under the policy rule, this is a locale/language constraint without visible opt-in or documented justification in the file.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a lower bound only, which allows future unreviewed versions to be installed and makes builds non-reproducible. In a trading automation skill, this increases supply-chain risk because changes in browser automation libraries can affect authentication and transaction flows in security-sensitive ways.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

playwright>=1.40.0
Pillow>=10.0.0
pytesseract>=0.3.10
requests>=2.31.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Pillow is unpinned, so installations may resolve to different versions over time, including versions with known security defects or behavioral changes. Because this skill performs captcha/image handling for brokerage login, image-processing code is part of a sensitive trust boundary and increases the relevance of dependency risk.

Content

Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.

text

playwright>=1.40.0
Pillow>=10.0.0
pytesseract>=0.3.10
requests>=2.31.0
pandas>=2.0.0

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Pillow has multiple published advisories, and because the manifest does not pin a version, there is no way to verify whether deployments are using a patched release. In this skill, Pillow likely processes captcha or login-related images, so a vulnerable image library could expose the host through crafted image inputs or denial-of-service conditions.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

Using a non-pinned pytesseract version permits uncontrolled upgrades and non-reproducible builds, which can introduce vulnerable or incompatible releases. In this skill, OCR is used around authentication workflows, so dependency instability can affect a high-risk operation path.

Content

Scanner excerpt · scripts/requirements.txt (reported line 3)May include surrounding context.

text

playwright>=1.40.0
Pillow>=10.0.0
pytesseract>=0.3.10
requests>=2.31.0
pandas>=2.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Requests is declared with only a minimum version, so dependency resolution may pull in unreviewed versions and obscure whether known fixes are present. Since the skill automates financial trading and may handle credentials or session traffic, supply-chain and transport-library uncertainty is more concerning than in a low-risk utility.

Content

Scanner excerpt · scripts/requirements.txt (reported line 4)May include surrounding context.

text

playwright>=1.40.0
Pillow>=10.0.0
pytesseract>=0.3.10
requests>=2.31.0
pandas>=2.0.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

Requests has known advisories, but the lack of version pinning makes it impossible to determine whether an installed environment includes the fixes. For a brokerage trading skill that may manage authenticated sessions and sensitive account data, uncertainty around the HTTP client version raises the risk of credential leakage or transport-related issues.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

Pandas is not pinned, which creates non-reproducible environments and allows future versions to be installed without review. Although pandas is less central to direct network access, this skill uses it in a financial/trading context where reliability and controlled dependencies still matter.

Content

Scanner excerpt · scripts/requirements.txt (reported line 5)May include surrounding context.

text

Pillow>=10.0.0
pytesseract>=0.3.10
requests>=2.31.0
pandas>=2.0.0

Static analysis

No suspicious patterns detected.