Security audit

Eastmoney Stock

Security checks for vulnerabilities and agentic risk

Overview

This stock-data skill is mostly a simple quote/ranking tool, but it is under-disclosed because it advertises Eastmoney while one quote script sends stock codes to Sina Finance and another uses an unencrypted Eastmoney HTTP endpoint.

Review before installing. The skill does not show evidence of credential theft, persistence, destructive behavior, or local data access, but users should know individual stock queries go to Sina Finance despite Eastmoney branding, sector data is fetched over unencrypted HTTP, and the advertised HK/U.S. support may not work reliably.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/sector_rank.py:19
Finding: Financial Market Data Retrieved Over Unencrypted HTTP
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill claims to use Eastmoney APIs, but the implementation reportedly calls Sina Finance instead, meaning the actual external service does not match the declared data source. Misrepresenting external dependencies is a serious trust and security issue because it bypasses source-level review expectations, can violate policy or compliance assumptions, and may expose user queries to an unapproved third party.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill claims to use Eastmoney APIs, but the implementation reportedly calls Sina Finance instead, meaning the actual external service does not match the declared data source. Misrepresenting external dependencies is a serious trust and security issue because it bypasses source-level review expectations, can violate policy or compliance assumptions, and may expose user queries to an unapproved third party.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill appears to require network access to fetch market data, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: the runtime may permit broader outbound access than users or reviewers expect, making misuse or unintended data exfiltration harder to detect and govern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module docstring and user-facing strings are written in Chinese and describe the tool specifically for Chinese stock-market usage, but the file does not indicate that this locale is optional or intentionally restricted. The policy requires flagging language or locale constraints when the skill effectively forces a specific language without opt-in or clear justification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest describes an 'eastmoney-stock' skill for querying 东方财富 (Eastmoney) stock data, but both the module/function docstrings explicitly state Sina Finance is used and the request URL targets hq.sinajs.cn. This is a clear description-behavior mismatch about the actual upstream data source, which can materially affect user expectations about data provenance and coverage.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The docstring says the function gets A股/港股/美股行情, but the parser requires at least 32 comma-separated fields and uses field positions documented for the A-share response format. The market classification logic only assigns specific handling for sh/sz codes, so the documentation overstates what the code demonstrably supports.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code sends a request to an external Sina Finance endpoint using the user-supplied stock code and custom HTTP headers, but there is no user-facing warning in the code comments, output, or prompts that data will be transmitted off-system. For code files, external network calls that transmit user or system data should include some disclosure unless the behavior is clearly communicated elsewhere.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.