ClawHub
Back to skill

Security audit

主板股票查询

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it uses Python to fetch public A-share stock listings from Baostock and save local JSON/CSV results.

Install only if you are comfortable with the script making a public Baostock network request and writing JSON/CSV files locally. For better reproducibility, pin baostock and pandas versions when installing in production or a shared environment.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Unpinned Dependencies

Low
Category
Supply Chain
Content
"author": "飞书助手",
  "license": "MIT",
  "dependencies": {
    "baostock": "^1.0",
    "pandas": "^2.0"
  }
}
Confidence
86% confidence
Finding
The dependency baostock is specified with a caret range (^1.0), which permits automatic installation of newer compatible releases. This can expose consumers to supply-chain risk if a future upstream release is compromised, malicious, or introduces unsafe behavior without review.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"license": "MIT",
  "dependencies": {
    "baostock": "^1.0",
    "pandas": "^2.0"
  }
}
Confidence
90% confidence
Finding
The dependency pandas is specified with a broad caret range (^2.0), allowing unreviewed minor/patch updates to be pulled in at install time. Even for a common library, this increases supply-chain exposure and can lead to unexpected behavior or newly introduced vulnerabilities reaching the skill automatically.

Static analysis

No suspicious patterns detected.