ClawHub
Back to skill

Security audit

miniQMT

Security checks for vulnerabilities and agentic risk

Overview

This skill is a transparent miniQMT trading helper, but it includes copy-ready live trading and money-transfer workflows without enough safety controls or confirmation guidance.

Install only if you intentionally want an agent or Python scripts to work with a logged-in miniQMT brokerage terminal. Treat all order, cancel, transfer, and bank-balance examples as live-account operations; add your own explicit confirmations, paper-trading checks, position limits, credential storage, and dependency pinning before use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned and Unverified Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-2; installation instructions also appear in SKILL.md:50 and README.md:20
Vulnerability Type: Supply-chain exposure through mutable dependency resolution
Risk Level: Medium

Vulnerable Code

text
xtquant>=1.0.0
pandas>=1.5.0

The installation instructions resolve packages directly without version or integrity verification:

bash
pip install xtquant

Technical Analysis

Both dependencies use open-ended minimum-version constraints. The project does not provide a lockfile, cryptographic hashes, an approved package index, or a documented package verification procedure. Consequently, separate installations can resolve to different package versions, including future versions that have not been reviewed with this Skill.

Python packages may execute code during installation and whenever imported. This is particularly sensitive for xtquant, because the packaged demo and documented trading programs import it in an environment that may have access to a locally authenticated miniQMT brokerage terminal. This finding does not establish that the current packages are malicious; it identifies the absence of controls preventing a compromised or unexpectedly changed release from entering the environment.

Attack Path

  1. An attacker compromises an allowed future release of a declared dependency or its package-distribution account.
  2. A user follows the documented installation command or installs from requirements.txt.
  3. Because only a minimum version is specified, the package manager selects the latest compatible release.
  4. Attacker-controlled code executes during package installation or import.
  5. The code operates with the privileges of the Python process and may interact with resources available to that process, including files, network connections, and an accessible brokerage service.

Impact Assessment

Successful ...[truncated 415 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace minimum-version constraints with exact versions that have been reviewed and tested.
  2. Generate a hash-locked dependency file and require hash verification during installation, for example through pip-compile --generate-hashes and pip install --require-hashes.
  3. Document the approved package registry and use an explicitly configured trusted index.
  4. Install dependencies in an isolated virtual environment under a non-privileged account.
  5. Review dependency release notes and package artifacts before updating pinned versions.
  6. Add automated dependency scanning and provenance verification to the release process.
  7. Avoid running package installation or trading programs with administrator privileges.

T09 · Insecure Skill Coding Practices

Note
Location
xttrader.md:1251
Finding

Banking Credentials and Account Identifiers Embedded in Documentation Examples

Content
View full analysis

Vulnerability Details

File Location: xttrader.md:1251, with comparable literal credential examples at lines 1284, 1318, 1350, and 1944
Vulnerability Type: Hardcoded sensitive-data pattern in financial API examples
Risk Level: Low

Vulnerable Code

python
result = xt_trader.bank_transfer_in(
    account, 'A', '0200205001003215076', 10, bank_pwd='abc123'
)

Comparable examples pass literal account identifiers and passwords to asynchronous bank transfers, outgoing transfers, and balance-query APIs.

Technical Analysis

The documentation demonstrates supplying a bank account identifier and password as source-code literals. The audited evidence does not establish that the displayed values are valid credentials; they appear to be examples. Nevertheless, the pattern encourages users to replace them with real values directly in scripts.

Credentials embedded in source code can be exposed through source-control history, shared notebooks, backups, screenshots, exception reports, or diagnostic logging. Financial credentials require stronger handling because the associated APIs include bank-to-broker transfers, broker-to-bank transfers, and bank-balance queries.

Attack Path

  1. A user copies the documented example into a trading script.
  2. The user replaces the example account and password literals with real banking credentials.
  3. The script is committed to source control, shared with another party, included in a notebook, backed up insecurely, or captured in logs.
  4. An unauthorized party retrieves the plaintext values.
  5. The exposed credentials are used against applicable banking or brokerage interfaces, subject to any additional authentication and authorization controls enforced by those services.

Impact Assessment

The immediate project finding is an insecure documentation pattern rather than proof of an active credential leak. If copied with real values, exposure could disclose a bank ...[truncated 296 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace realistic literals with unmistakable placeholders such as BANK_ACCOUNT_FROM_SECURE_STORE and BANK_PASSWORD_FROM_SECURE_PROMPT.
  2. Demonstrate interactive password collection with a non-echoing input mechanism, such as Python's getpass, when supported by the workflow.
  3. Prefer an operating-system credential manager or broker-approved secret-storage facility for unattended execution.
  4. Add an explicit warning that bank and fund passwords must not be committed to source control, stored in notebooks, printed, or written to logs.
  5. Ensure errors and callback handlers redact account numbers and passwords.
  6. Add secret scanning to documentation and source-control checks.
  7. Where feasible, require transaction confirmation, transfer limits, and broker-side multi-factor authentication.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file documents direct trading, cancellation, fund transfer, bank transfer, and internal transfer operations without prominent warnings about financial loss, irreversible effects, credential sensitivity, or the need for explicit user authorization. In an agent-skill context, omission of such safeguards is dangerous because automated systems may invoke these APIs as routine actions even though they can move money or place live market orders.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trading example shows a live order placement call using a real account object and concrete parameters, but it does not warn that this can execute an actual market transaction with financial consequences. In the context of a quant trading terminal, readers may copy-paste the snippet directly, making unintended real trades more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README explicitly promotes real-money trading capabilities, including live stock and ETF trading, but does not warn users that actions may affect actual brokerage accounts and funds. In an agent/skill context, missing destructive-action warnings can lead users or downstream automation to treat examples as harmless, increasing the risk of unintended financial transactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trading example shows direct order submission code against a real account object without any surrounding warning, dry-run guidance, or indication that it may execute a live buy order. In a skill intended for automation, copy-pasting or agent-driven use of this snippet could trigger unintended market orders and direct monetary loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This skill includes multiple ready-to-run examples that place live orders, subscribe accounts, query assets, and run automated strategies, but it does not present a prominent safety warning that these examples can trigger real brokerage activity and financial loss. In the context of an agent skill, this is especially risky because an automated system may adapt or execute the examples directly against a logged-in trading terminal, turning instructional content into unintended live trading behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a minimal quantitative trading terminal that supports external Python for market data and programmatic trading based on xtquant SDK. This file documents not only market/financial data access but also state-changing management of custom sector folders, sectors, and their constituents inside MiniQMT, which is broader than the stated market-data-oriented scope of this module.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

remove_sector is a destructive operation that can delete user-defined board/sector data, yet the documentation provides no warning, confirmation guidance, backup advice, or note on reversibility. In an agent or automation context, undocumented destructive operations increase the chance of accidental or unauthorized state changes that can disrupt user workflows or erase configuration data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

reset_sector overwrites existing board membership and can replace prior user configuration without any warning about data loss or replacement semantics. In automation scenarios, this can cause unintended destructive changes at scale, especially if an agent invokes it based on ambiguous input or stale state.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill metadata describes the capability as minimal market data and programmatic trading, but the document also exposes bank transfer, internal fund transfer, and external transaction import features. This scope understatement is dangerous because downstream agents or users may grant the skill broader trust than intended, enabling movement of funds or sensitive account operations without appropriate review or consent boundaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The natural-language content, headings, and instructions all assume Chinese as the required language. Under the policy criteria, forcing a specific language without user opt-in or documented justification can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file presents all user-facing instructions in Chinese, including the title and usage steps, with no indication that language selection is optional or that the skill is intended only for a Chinese-speaking audience. Under the policy rule for language or locale constraints, this can be considered a forced language choice without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest description is written entirely in Chinese and presents the skill in that locale without any indication that language selection is optional or region-specific. Under the language/locale policy rule, this can be a natural-language policy violation when a specific language is imposed without user opt-in or justification.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency specification for xtquant uses a lower-bound only constraint, which allows future versions to be installed without review. This weakens build reproducibility and can expose consumers to breaking or compromised upstream releases through the software supply chain.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
xtquant>=1.0.0
pandas>=1.5.0

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The pandas dependency is also unpinned, so installations may resolve to different versions over time. This creates supply-chain risk and makes it harder to verify whether deployed environments include vulnerable or incompatible releases.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
xtquant>=1.0.0
pandas>=1.5.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
74% confidence
Finding

The manifest does not pin pandas, so it is impossible to determine from this file alone whether an affected version could be installed. In a trading-related skill that may process external market data, uncertainty around dependency versions increases operational and security risk because vulnerable environments cannot be ruled out.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
99% confidence
Finding

The function name remove_stock_from_sector clearly indicates a destructive update to sector membership, but the accompanying '释义' says 创建板块 (create sector). This is an active contradiction in the documentation that can mislead developers about the function's side effects and intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The comment says the example is using the asynchronous order interface, but the code calls xt_trader.order_stock(...) rather than xt_trader.order_stock_async(...). This actively misrepresents the behavior of the sample and could mislead integrators about callback semantics.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The section title and function signature describe sync_transaction_from_external, which imports external transaction data into the system. However, the 释义 says '通用数据导出', which is the opposite direction of data flow and contradicts the interface purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The function name ctp_transfer_future_to_option indicates a transfer from futures to options, but the 释义 still says 'CTP资金内转（期权转期货）'. This directly contradicts the documented direction of funds movement.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The skill description focuses on market data retrieval and programmatic trading, but this file also documents exporting arbitrary account data to caller-chosen CSV paths and re-reading/deleting those files. While adjacent to trading workflows, this is a broader local file I/O capability than the manifest makes clear.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The function name query_bank_amount and returned fields such as balance and enable_balance indicate a bank balance lookup. The 释义 instead says '银行转账流水查询', which is a different operation and conflicts with the rest of the section.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.