杨永兴尾盘选股

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:51 AM UTC
• Version: 1.0.0

Overview

This is a disclosed Chinese A-share stock-screening skill, but its install and market-data integrity risks deserve user caution.

Install only in an isolated environment, avoid npm install for this package, pin and review Python dependencies before running, and do not treat its stock output as verified financial advice. Be especially cautious because realtime quote data is fetched over plaintext HTTP and can be manipulated on untrusted networks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: package.json:17

Finding

Unpinned and Cross-Ecosystem Dependency Declarations

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: yang_selection.py:128

Finding

Financial Quote Data Retrieved over Plaintext HTTP

Content

View full analysis

`. 3. The attacker intercepts the request and returns a forged response containing the expected tilde-delimited field structure. 4. The script parses the forged price, turnover, volume, and market-cap values without authenticity validation. 5. The modified values influence screening results displayed to the user. 6. If the forged market capitalization is positive and below the configured threshold, the affected symbol can also be written to `market_cap_cache.json` and excluded from later runs for up to 30 days. ### Impact Assessment The attacker can manipulate the integrity of stock-screening inputs and resulting recommendations. They may cause legitimate stocks to be excluded, caus ...[truncated 393 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire README is written in Chinese and does not indicate that other languages are supported or that Chinese is a required, justified locale for this skill. Per the policy, language-specific behavior or presentation should either offer user opt-in/choice or clearly document a justified regional constraint.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises and documents behavior that requires network access plus local file read/write, but it does not declare any explicit tool scope or permission boundaries. This creates unnecessary ambiguity about what the skill is allowed to access and increases the risk of over-privileged execution, especially since it reaches external finance APIs and persists cache data locally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language content of the skill, including its name, description, and usage instructions, is presented only in Chinese. Under the policy, forcing a specific language without user opt-in is a language/locale policy violation unless the locale restriction is explicitly justified, which is not documented here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The advanced filter expects realtime fields such as 'high' and 'volume', but the code passes reduced candidate objects containing only code, name, price, pctChg, turnover, and market_cap. This mismatch can cause runtime errors or incorrect screening results, which makes the skill unreliable and susceptible to denial-of-service through malformed or merely normal execution paths.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency uses a caret version range, which allows newer releases within the major version to be installed. This weakens build reproducibility and can introduce vulnerable or malicious upstream changes through the supply chain without any change to this repository. In a skill that fetches live financial data, third-party packages are part of the trust boundary, so dependency drift is a real risk.

Content

Scanner excerpt · package.json (reported line 20)May include surrounding context.

json

"author": "飞书助手",
  "license": "MIT",
  "dependencies": {
    "baostock": "^1.0",
    "pandas": "^2.0",
    "numpy": "^1.0",
    "requests": "^2.0"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using an unpinned pandas version allows the installed package to vary over time, reducing reproducibility and increasing exposure to supply-chain compromise or newly introduced vulnerabilities. Because this skill appears to process external market data, compromise in a data-handling library could affect integrity or availability of results.

Content

Scanner excerpt · package.json (reported line 21)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "baostock": "^1.0",
    "pandas": "^2.0",
    "numpy": "^1.0",
    "requests": "^2.0"
  }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The numpy dependency is not pinned to a specific version, so future installs may resolve to different releases. That creates a supply-chain and stability risk, since vulnerable or incompatible transitive code can be introduced unexpectedly.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json

"dependencies": {
    "baostock": "^1.0",
    "pandas": "^2.0",
    "numpy": "^1.0",
    "requests": "^2.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The requests package is unpinned, allowing silent upgrades to newer releases within the permitted range. Since this skill likely performs network access to external financial services, a compromised or vulnerable HTTP client dependency could directly affect confidentiality, integrity, or availability of fetched data and outbound requests.

Content

Scanner excerpt · package.json (reported line 23)May include surrounding context.

json

"baostock": "^1.0",
    "pandas": "^2.0",
    "numpy": "^1.0",
    "requests": "^2.0"
  }
}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This file contains user-facing natural-language descriptions, comments, and console output exclusively in Chinese, which effectively imposes a specific language on users. Under the language/locale policy, a skill should not force a language unless it offers user choice or clearly documents a justified locale constraint.

Content

No source excerpt is available for this finding.