ClawHub
Back to skill

Security audit

BaoStock

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent BaoStock helper for Chinese A-share market data, with ordinary package-installation and CSV-export risks but no hidden or destructive behavior found.

Install this in a virtual environment and consider pinning reviewed versions of baostock and pandas before use. Be aware that running the sample scripts contacts BaoStock and that the CSV examples create or overwrite files with the shown filenames.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Mutable Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:15-16
Vulnerability Type: Unpinned third-party dependencies and unconditional package upgrades
Risk Level: Medium

Vulnerable Code

bash
pip install baostock --upgrade

Related mutable dependency declarations also appear in:

  • README.md:18-19
  • demo_project/README.md:7-9
  • requirements.txt:1-2
  • metadata.json:17-21
text
baostock>=0.8.0
pandas>=1.5.0
json
"dependencies": {
  "python": ">=3.8",
  "packages": [
    "baostock>=0.8.0",
    "pandas>=1.5.0"
  ]
}

Technical Analysis

The installation instructions use --upgrade, while the dependency manifests specify only minimum versions. Consequently, installation can resolve to future package releases that were not reviewed during this audit. The project provides no exact version pins, lockfile, package hashes, or other integrity verification.

The package names are consistent throughout the project, and the audited files contain no evidence of typosquatting, dependency confusion, or a currently malicious dependency. The risk arises from mutable dependency resolution: if a qualifying future release or its distribution channel is compromised, users following the documented installation process could install attacker-controlled code.

Python packages may execute code during installation, and their modules execute code when imported. Both baostock and pandas are imported by the supplied examples, including demo_project/demo.py:1-2.

Attack Path

  1. An attacker compromises a dependency publisher account, package build pipeline, or distribution channel.
  2. The attacker publishes a malicious release newer than the locally installed version and compatible with the lower-bound constraints.
  3. A user runs the documented pip install baostock --upgrade command or installs from requirements.txt.
  4. Pip resolves and installs the malicious qualifying release because no exact version or integrity hash prevents it. ...[truncated 877 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace lower-bound-only constraints with exact versions that have been reviewed and tested:

    text
    baostock==REVIEWED_VERSION
pandas==REVIEWED_VERSION

  2. Remove unconditional --upgrade from user-facing installation instructions. Install from a controlled requirements file instead:

    bash
    python3 -m pip install --require-hashes -r requirements.lock

  3. Generate a lockfile containing exact transitive dependency versions and SHA-256 hashes. Commit it to the project and update it only through a reviewed dependency-upgrade process.

  4. Verify package provenance and retrieve dependencies exclusively from an approved package index over TLS. In CI, explicitly configure the trusted index rather than inheriting arbitrary user-level pip configuration.

  5. Add automated dependency scanning and release review. Test upgrades in an isolated environment before updating the lockfile.

  6. Run installation and demonstrations in a virtual environment or restricted container under a non-privileged account. Avoid installing these packages globally or with administrator privileges.

  7. Keep dependency declarations synchronized across requirements.txt, metadata.json, README.md, SKILL.md, and the demo documentation so that all installation paths enforce the same reviewed versions.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file forces a specific language/locale in its user-facing description and operational guidance, which can violate language-choice policy when no opt-in or alternative is provided. This is reinforced throughout the document, making the skill effectively Chinese-only by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

该文件从标题到说明全文均以中文呈现，且未说明这是面向特定中文用户群体的区域性文档，也未提供其他语言选项。按规则，未经用户选择而固定单一语言属于自然语言层面的语言/地区策略风险。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README presents all user-facing instructions and descriptions exclusively in Chinese. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This section instructs the user or agent to write query results to a CSV file, which can affect local data and potentially overwrite existing files, but the surrounding markdown does not include any warning or caution. Under the markdown-file criteria, behaviors affecting user data should be disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The example generates and saves multi_stock_baostock.csv, which is a user-data-affecting behavior, but the markdown does not warn that a local file will be created or overwritten. Even in illustrative examples, the skill description should disclose such file-writing effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file presents all user-facing instructions in Chinese, which can force a specific language on users without opt-in. The policy allows fixed locale only when justified or when users are given a choice, neither of which appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description is written entirely in Chinese and provides no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language or region-specific audience. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The dependency specification uses a lower-bound only constraint, which allows future unreviewed versions of baostock to be installed. This weakens build reproducibility and increases supply-chain risk because a compromised or breaking upstream release could be pulled in without notice.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
baostock>=0.8.0
pandas>=1.5.0

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The pandas dependency is also unpinned, so installs may resolve to different versions over time. That creates uncertainty around both security posture and runtime behavior, especially for a data-processing package with a large transitive ecosystem.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
baostock>=0.8.0
pandas>=1.5.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.