vnpy

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:44 PM UTC
• Version: 1.0.2

Overview

This skill is a legitimate vn.py trading-framework guide, but it includes live trading and order-execution examples without enough safety scoping for real financial accounts.

Review before installing. Use an isolated environment, prefer pinned and reviewed dependency versions, start only with simulation or paper-trading accounts, and do not let an agent connect broker credentials or start strategies without explicit human confirmation and risk limits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies Permit Unreviewed Package Installation

Content

View full analysis

Vulnerability Details

File Locations:

• requirements.txt:1-2
• metadata.json:19-23
• README.md:17-20
• SKILL.md:18-30
• demo_project/README.md:7-10

Vulnerability Type: Dependency supply-chain exposure through unpinned packages
Risk Level: Medium

Relevant Code Snippets:

requirements.txt:1-2

text

vnpy>=3.0.0
vnpy-ctp>=6.0.0

metadata.json:19-23

json

"packages": [
  "vnpy>=3.0.0",
  "vnpy-ctp>=6.0.0"
]

README.md:17-20

bash

pip install vnpy vnpy-ctp vnpy-ctastrategy

SKILL.md:18-30

bash

# Install core framework
pip install vnpy

# Install CTP gateway (futures)
pip install vnpy-ctp

# Install common components
pip install vnpy-ctastrategy    # CTA strategy module
pip install vnpy-spreadtrading  # Spread trading module
pip install vnpy-datamanager    # Data management module
pip install vnpy-sqlite         # SQLite database
pip install vnpy-rqdata         # RQData data service

demo_project/README.md:7-10

bash

pip install -r ../requirements.txt

Technical Analysis

The project instructs users to install third-party Python packages without exact version pins or integrity hashes. The constraints in requirements.txt and metadata.json are lower bounds, meaning that any future version satisfying those bounds may be installed. The direct pip install commands impose no version constraint at all.

Consequently, the effective code installed by following the project documentation can change after this project has been reviewed. Python package installation may execute package build hooks, while installed modules execute code when imported or invoked. If a dependency publisher account, package repository, distribution artifact, or future compatible release is compromised, an attacker-controlled package can enter the installation path without requiring any change to this repository.

This findi ...[truncated 1697 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace lower-bound constraints with exact, reviewed versions, for example:

   text

   vnpy==REVIEWED_VERSION
   vnpy-ctp==REVIEWED_VERSION
   

2. Generate a lock file containing all transitive dependencies rather than locking only direct dependencies.
3. Record cryptographic hashes for every approved distribution and enforce them with:

   bash

   pip install --require-hashes -r requirements.lock
   

4. Update all installation examples to use the reviewed lock file instead of unconstrained pip install commands.
5. Explicitly document the trusted package index and use an index allowlist where the deployment system supports it.
6. Install dependencies in an isolated virtual environment or container under a non-privileged account.
7. Review dependency updates before changing the lock file, including package provenance, release history, maintainers, build configuration, and vulnerability advisories.
8. Use automated dependency scanning and test updated packages in a non-production environment before permitting access to broker credentials or live trading services.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill includes a concrete live-trading configuration and code path that connects to a broker and starts a strategy, but it does not clearly warn that executing the example can place real orders and change positions. In an agent context, this is dangerous because automation may treat the snippet as an ordinary runnable example and trigger real market activity, causing financial loss or unintended trades.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This is a markdown file, so SQP-2 applies. The section documents order placement and cancellation methods such as buy, sell, short, cover, and cancel_all, but provides no warning that these actions can place or cancel real orders and affect user funds or positions if used against a live trading environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README includes executable trading strategy examples that directly call buy/sell methods and describe broker connectivity, but it does not warn users that these examples may place real orders or that misuse can cause financial loss from live-market execution, bad data, or system/configuration errors. In the context of a trading framework skill, this omission increases the chance that a user copies code into a live environment without understanding operational and market risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

SQP-3 applies to all file types and includes language or locale policy violations. The file content, headings, and descriptions are all presented only in Chinese, with no user opt-in, alternative language option, or justification that the skill is region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The skill documentation forces a single language/locale for all instructions and examples, with no opt-in or alternative language guidance. Under the stated policy, language constraints should either be optional for users or clearly documented as justified by region-specific scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents usage instructions in Chinese, but does not offer an alternative language or state that the skill is intentionally region- or language-specific. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The program prints all user-facing status and error messages in Chinese, such as the initialization and failure notices. This imposes a specific language on users without any opt-in or indication that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This manifest file only provides a general product-style description of the trading framework and does not indicate when the skill should be activated or what phrases should invoke it. In a manifest context, the lack of trigger scope or exclusion conditions can lead to overly broad matching or unintended invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill metadata presents its description and tags entirely in Chinese, which may impose a language-specific experience without documenting that constraint or offering a language choice. The policy requires either user opt-in for a specific language/locale or a clearly documented justification for the locale restriction.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a lower-bound range rather than an exact version, so installs may resolve to different upstream releases over time. This creates a supply-chain and reproducibility risk: a newly published vulnerable or malicious version satisfying the constraint could be pulled into the environment without review, which is especially concerning in a trading framework that may handle credentials, market connectivity, and automated execution.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

vnpy>=3.0.0
vnpy-ctp>=6.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

This package is also unpinned and may resolve to any future version meeting the minimum requirement, which can silently introduce breaking changes, known vulnerabilities, or compromised releases. Because vnpy-ctp is a broker/connectivity component in a quantitative trading context, unexpected dependency drift could affect sensitive market access and execution paths.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

vnpy>=3.0.0
vnpy-ctp>=6.0.0

Static analysis

No suspicious patterns detected.