ClawHub
Back to skill

Security audit

xtdata

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a market-data guide, but it also bundles high-impact live trading and money-transfer documentation that is not clearly scoped or warned about.

Review this as a high-risk financial integration, not a simple market-data skill. Only install or use it in an isolated environment tied to accounts you intend to expose, avoid copying live order or bank-transfer examples, replace all sample credentials with secure secret handling, and require explicit human confirmation before any order, cancellation, transfer, export, import, or sector deletion/reset action.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Third-Party Dependencies Permit Unreviewed Package Code Execution

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-2
Additional Locations: SKILL.md:15-18, demo_project/README.md:7-10
Vulnerability Type: Unpinned and unhashed third-party dependencies
Risk Level: Medium

The project installs dependencies using unrestricted minimum-version constraints:

text
xtquant>=1.0.0
pandas>=1.5.0

The installation instructions cause these dependencies and their transitive dependencies to be installed and executed:

bash
pip install xtquant
bash
pip install -r ../requirements.txt

Technical Analysis

The >= constraints allow the package resolver to install any current or future version satisfying the minimum version. No lock file, package hashes, exact versions, or trusted package-index configuration are provided.

Python package installation can execute package build logic, while subsequent imports execute installed package initialization code. The implementation of xtquant is not included in this project, so the audit could not verify the behavior of the code users are instructed to install.

This does not establish that the named packages are currently malicious. It creates a supply-chain weakness in which future releases, a compromised publisher account, a compromised package index, or unsafe index precedence could introduce code that was never reviewed with this project.

Attack Path

  1. An attacker compromises a dependency publisher, distribution channel, or package source used by the installer.
  2. The attacker publishes a malicious package release with a version satisfying xtquant>=1.0.0 or pandas>=1.5.0.
  3. A user follows the documented installation command without a previously locked environment.
  4. The resolver selects the attacker-controlled or compromised release.
  5. Malicious code executes during installation, import, or normal package use with the privileges of the user running Python.

Impact Asses

...[truncated 475 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace minimum-version constraints with exact, reviewed versions, for example:
    text
    xtquant==REVIEWED_VERSION
pandas==REVIEWED_VERSION
  2. Generate and commit a reproducible lock file that includes all transitive dependencies.
  3. Require package hashes during installation, such as through a hash-locked requirements file and pip install --require-hashes.
  4. Document and enforce the intended trusted package index rather than relying on ambient installer configuration.
  5. Review package artifacts, release provenance, signatures, and dependency changes before updating locked versions.
  6. Install dependencies in an isolated virtual environment under a non-privileged account.
  7. Add automated dependency vulnerability and integrity scanning to the release process.

other

Error
Location
xttrader.md:220
Finding

Bundled Trading Example Can Submit Live Financial Orders Outside the Declared Market-Data Scope

Content
View full analysis

Vulnerability Details

File Location: xttrader.md:220-253
Vulnerability Type: Undeclared live financial transaction capability
Risk Level: High

Although the project is presented as an XtData market-data Skill, it bundles a directly executable trading example that creates an account object, connects to the trading service, submits an order, and cancels it:

python
if __name__ == "__main__":
    print("demo test")
    # path为mini qmt客户端安装目录下userdata_mini路径
    path = 'D:\\迅投极速交易终端 睿智融科版\\userdata_mini'
    # session_id为会话编号，策略使用方对于不同的Python策略需要使用不同的会话编号
    session_id = 123456
    xt_trader = XtQuantTrader(path, session_id)
    # 创建资金账号为1000000365的证券账号对象
    acc = StockAccount('1000000365')
    # StockAccount可以用第二个参数指定账号类型，如沪港通传'HUGANGTONG'，深港通传'SHENGANGTONG'
    # acc = StockAccount('1000000365','STOCK')
    # 创建交易回调类对象，并声明接收回调
    callback = MyXtQuantTraderCallback()
    xt_trader.register_callback(callback)
    # 启动交易线程
    xt_trader.start()
    # 建立交易连接，返回0表示连接成功
    connect_result = xt_trader.connect()
    print(connect_result)
    # 对交易回调进行订阅，订阅后可以收到交易主推，返回0表示订阅成功
    subscribe_result = xt_trader.subscribe(acc)
    print(subscribe_result)
    stock_code = '600000.SH'
    # 使用指定价下单，接口返回订单编号，后续可以用于撤单操作以及查询委托状态
    print("order using the fix price:")
    fix_result_order_id = xt_trader.order_stock(acc, stock_code, xtconstant.STOCK_BUY, 200, xtconstant.FIX_PRICE, 10.5, 'strategy_name', 'remark')
    print(fix_result_order_id)
    # 使用订单编号撤单
    print("cancel order:")
    cancel_order_result = xt_trader.cancel_order_stock(acc, fix_result_order_id)
    print(cancel_order_result)
    # 使用异步下单接口，接口返回下单请求序号seq，seq可以和on_order_stock_async_response的委托反馈response对应起来
    print("order using async api:")
    async_seq = xt_trader.order_stock(acc, stock_code, xtconstant.STOCK_BUY, 200, xtconstant.FIX_PRICE, 10.5, 'strategy_name', 'remark')

Technical Analysis

The ...[truncated 2031 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove xttrader.md from this market-data-only Skill and publish trading functionality as a separately declared, separately reviewed component.
  2. If the documentation must remain, replace executable order calls with non-runnable pseudocode.
  3. Clearly label every trading example as capable of placing real orders and distinguish it from market-data retrieval.
  4. Default examples to an authenticated paper-trading or simulation environment and reject production accounts unless the user explicitly opts in.
  5. Require an interactive confirmation that displays the account, instrument, side, quantity, price, and maximum estimated exposure before submission.
  6. Add configurable position, quantity, notional, price-deviation, and duplicate-order limits.
  7. Verify connection and subscription results before allowing any transaction.
  8. Correct the purported asynchronous example to use the intended asynchronous API, and ensure that examples cannot accidentally submit duplicate orders.
  9. Avoid printing complete account identifiers or sensitive portfolio data; redact identifiers in logs.
  10. Test cancellation outcomes explicitly and warn that submitting an order followed by cancellation is not a safe simulation mechanism.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (23)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file documents capabilities far beyond market-data access, including live trading, order cancellation, fund transfers, bank-linked transfers, and external transaction import. In a skill described as a行情数据模块, this scope expansion increases the chance that an agent or user will invoke high-risk financial actions unexpectedly or without appropriate controls.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Bank account queries and funds-transfer APIs are highly sensitive financial operations and are not justified by the stated purpose of a market-data module. This mismatch makes accidental or unauthorized money movement more plausible, especially if an agent assumes the skill is read-only because of its metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

Bank and internal transfer APIs are documented without strong warnings about credential sensitivity, irreversible fund movement, or the need for secure secret handling. This omission is dangerous because users may paste credentials into scripts, logs, or agent prompts and perform high-impact transfers without appreciating the risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes the skill as a行情数据模块 providing real-time quotes, K-line, Tick, Level2, and financial data. However, this section includes state-changing management operations such as creating sector folders, creating sectors, adding/removing stocks, resetting contents, and deleting sectors, which are portfolio/watchlist-management behaviors rather than pure data provision.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The AI-agent guidance and support sections are presented exclusively in Chinese, including directives aimed at agent behavior, with no indication that another language can be used. This can violate a language/locale policy when users or agents are not given an explicit choice or opt-in for Chinese-only operation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest describes xtdata as a行情数据模块 providing real-time quotes, K-lines, Tick, Level2, and financial data. However, this file also documents mutating management operations for user-defined sectors, including creating folders/sectors and adding, removing, or resetting constituents, which are administrative modification capabilities rather than data retrieval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The documentation exposes destructive local-state operations such as removing sectors, resetting sectors, and removing stocks from sectors without clearly warning that they mutate or delete user-defined configuration. In an agent or automation context, this increases the risk of unintended destructive actions against a user's local MiniQmt workspace, especially if a model treats these APIs as equivalent to harmless data queries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The quick-start example places and cancels live orders with no warning that these are real-money, market-impacting operations. In the context of an SDK skill likely to be used by agents or copied by users, this increases the risk of accidental trading in production environments.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The external transaction import interface allows modification or insertion of deal records, which is unrelated to market-data retrieval and creates integrity risk. If misused, it could corrupt trading records, mislead downstream accounting or strategy logic, or be abused to falsify activity.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation includes plaintext banking credentials and a full bank account number in example code. Even if illustrative, such patterns normalize insecure secret handling, encourage copy/paste into source files and logs, and may expose real-looking financial identifiers in downstream datasets or training corpora.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

These additional examples again expose full bank account numbers and plaintext passwords, reinforcing unsafe credential practices around sensitive transfer operations. Repetition increases the likelihood that users will replicate the insecure pattern directly in production automation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The transfer-out and related query examples show sensitive banking identifiers and passwords in clear text. This creates unnecessary exposure of financial data patterns and promotes insecure storage and handling of secrets during automation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The section title and function name say '期货转期权', but the 释义 line says 'CTP资金内转（期权转期货）'. This is a direct contradiction about the destination/source of transferred funds and could cause operator error.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Generic export/query functions writing to arbitrary file paths exceed the expected scope of a market-data module and can expose sensitive account and trade data to uncontrolled locations. Arbitrary-path export also increases the risk of overwriting files, insecure local persistence, and unintended data exfiltration through agent-controlled paths.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The bank amount query example includes a plaintext bank password and full bank account number in sample code for a sensitive banking function. In an agent-skill context, this is especially risky because examples are often reused verbatim and may be surfaced in logs, prompts, or generated scripts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The markdown file is entirely written in Chinese, including the title, headings, and usage notes, with no indication that language selection is optional or that the skill is intended only for a Chinese-language audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file presents the skill instructions entirely in Chinese, which can constitute a language policy violation when users are not given an explicit language or locale option. The file does not indicate that the skill is region-specific or provide an opt-in mechanism for this language choice.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency specifier xtquant>=1.0.0 is unpinned, so future installs may resolve to different versions with changed behavior or newly introduced vulnerabilities. This creates a supply-chain and reproducibility risk, even though the file itself does not show active exploitation logic.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
xtquant>=1.0.0
pandas>=1.5.0

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency pandas>=1.5.0 is also unpinned, allowing environment-dependent resolution to different releases over time. That weakens build reproducibility and can expose consumers to vulnerable or incompatible versions if upstream packages are compromised or regress.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
xtquant>=1.0.0
pandas>=1.5.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
99% confidence
Finding

The function name remove_stock_from_sector clearly indicates deletion of constituents from an existing sector. But the accompanying description at L1121 says '创建板块' (create sector), which directly contradicts the documented operation and could mislead developers about its side effects.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
99% confidence
Finding

The section title and function name describe external transaction data import, but the 释义 line states '通用数据导出'. That is an active documentation contradiction about whether the interface imports transaction data or exports generic data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The function name and parameters indicate a bank balance query requiring bank credentials, but the 释义 says '银行转账流水查询' and the return description says '银行转账流水信息'. This contradicts the actual documented behavior of returning balance and transferable amount.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.