ClawHub
Back to skill

Security audit

AKShare

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent AKShare financial-data helper with ordinary network-backed data examples and no hidden persistence, credential access, or destructive behavior.

Before installing, use a virtual environment and consider pinning exact reviewed versions of akshare and pandas. Expect AKShare calls to contact external financial data providers over the network and avoid treating returned data as investment advice.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unbounded Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-2, README.md:19, SKILL.md:18, SKILL.md:258, demo_project/README.md:9
Vulnerability Type: Unpinned and automatically upgraded third-party dependencies
Risk Level: Medium

Vulnerable Code

requirements.txt:1-2

text
akshare>=1.0.0
pandas>=1.5.0

README.md:19 and SKILL.md:18

bash
pip install akshare --upgrade

SKILL.md:258

python
import mplfinance as mpf  # pip install mplfinance

demo_project/README.md:9

bash
pip install -r ../requirements.txt

Technical Analysis

The dependency constraints specify only minimum versions, allowing pip to install any later release of akshare or pandas. The documented --upgrade command explicitly requests the newest available AKShare release, and the optional mplfinance installation instruction does not specify a reviewed version.

Python packages and their transitive dependencies can execute code during build and installation processes and when imported at runtime. Because dependency versions and artifact hashes are not fixed, the code ultimately installed can differ from what was reviewed. A compromised upstream account, malicious package release, compromised transitive dependency, or package-index incident could therefore introduce attacker-controlled code into the environment.

This is a supply-chain weakness rather than evidence that the currently named packages are malicious.

Attack Path

  1. An attacker compromises an upstream package, one of its transitive dependencies, or its package-distribution account.
  2. The attacker publishes a malicious version that still satisfies the lower-bound constraints, or publishes it as the newest version selected by --upgrade.
  3. A user follows the documented installation instructions or installs requirements.txt.
  4. Pip resolves and downloads the attacker-controlled release because n ...[truncated 927 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace minimum-version constraints with exact, reviewed versions:
    text
    akshare==<reviewed-version>
pandas==<reviewed-version>
mplfinance==<reviewed-version>
  2. Generate a lock file that includes all transitive dependencies rather than pinning only direct dependencies.
  3. Record and enforce package hashes, for example by using:
    bash
    python -m pip install --require-hashes -r requirements.txt
  4. Remove --upgrade from routine installation instructions. Perform upgrades only through a controlled dependency-review process.
  5. Install dependencies from the official package index or an authenticated internal mirror with provenance and integrity controls.
  6. Scan proposed dependency updates for known vulnerabilities and review unexpected changes to transitive dependencies.
  7. Perform installation and execution in an isolated virtual environment or container under a non-privileged account.
  8. Keep build environments free of unnecessary credentials and restrict outbound network access where operationally feasible.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill description and nearly all user-facing instructions are presented only in Chinese, including the manifest description and operational guidance, with no indication that this locale is optional or intentionally restricted to a China-specific audience. The policy requires flagging language or locale constraints when the skill effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file presents all user-facing instructions in Chinese, which effectively forces a specific language for understanding and use. Under the policy, locale or language constraints should be optional or clearly justified; this README provides neither a language choice nor a documented regional reason.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This manifest presents the skill description and tags entirely in Chinese, which imposes a specific language/locale on users without offering a choice or documenting that the skill is intended only for a Chinese-language audience. The policy explicitly flags language or locale constraints when they are forced without user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This markdown file is natural-language documentation, and it presents all instructions and descriptions exclusively in Chinese. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file demonstrates direct use of AKShare data-fetching APIs, which inherently make outbound requests to external data providers, but it does not disclose that using the skill will contact third-party services. For a skill centered on retrieving financial data, a brief notice about network access and external data sources would improve user awareness around privacy and connectivity expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This markdown file documents many AKShare calls that fetch remote financial data, but it does not provide a user-facing warning that using the skill will contact external data providers and transmit request metadata. Under the markdown-specific warning rule, network-backed behavior that may affect privacy should be disclosed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency specification uses a lower-bound only constraint, which allows installation of any newer akshare release, including versions with unreviewed behavior changes or future supply-chain issues. While this is common in development, it reduces build reproducibility and weakens control over the exact code that will run.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
akshare>=1.0.0
pandas>=1.5.0

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The pandas requirement is also unpinned, so deployments may resolve to different versions over time, including releases with regressions or security issues. This creates a supply-chain and reproducibility risk because the installed package is not fixed to a reviewed version.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
akshare>=1.0.0
pandas>=1.5.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.