T06 · System Persistence
Error
- Location
SKILL.md:101- Finding
Persistent Weekday Execution Through a Scheduled Task
- Content
View full analysis
- Remediation
View remediation
Security audit
Quant Stock Picker Pro
Security checks for vulnerabilities and agentic risk
Overview
This A-share stock-picking skill is not proven malicious, but it installs broad dependencies, sets up recurring unattended runs, changes network behavior, and makes overstated financial-analysis claims.
Review carefully before installing. Only run it in an isolated environment, avoid enabling the cron job unless you truly want unattended weekday execution, pin dependencies, remove the hard-coded sys.path and proxy overrides, and treat all stock recommendations as experimental rather than investment advice.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:101- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/quant-stock-picker-ultimate-integrated.py:20- Finding
External Directory Precedes Audited Modules in Python Import Resolution
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/quant-stock-picker-ultimate-integrated.py:16- Finding
Process-Wide Bypass of Configured HTTP and HTTPS Proxies
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/quant-stock-picker-ultimate-integrated.py:74- Finding
Decision-Critical Market Data Retrieved Over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
other
Error
- Location
scripts/quant-stock-picker-ultimate-integrated.py:357- Finding
Synthetic and Circular Metrics Presented as AI-Enhanced Financial Analysis
- Content
View full analysis
3% is positive) y = (df['涨跌幅'] > 3).astype(int) # Train random forest rf_model = RandomForestClassifier(n_estimators=100, max_depth=5, random_state=42, n_jobs=-1) rf_model.fit(X, y) # Predict probabilities df['ai_prob'] = rf_model.predict_proba(X)[:, 1] # AI score df['ai_score'] = (df['ai_prob'] * 10).round(0) # Integrate into total score df['score'] += df['ai_score'] print("✅ AI model training complete") print(f"Model accuracy: {rf_model.score(X, y):.2%}") ``` Synthetic metrics are also produced in `scripts/data_collector.py:180-194`: ```python # Final fallback: simulated data based on stock-code hash np.random.seed(hash(stock_code + 'search') % 2**32) search_index = np.random.randint(100, 10000) trend_7d = np.random.uniform(-30, 50) return { 'search_index': search_index, 'trend_7d': trend_7d, 'heat_level': heat_level, 'attention_score': min(100, search_index / 100), 'data_source': 'mock' } ``` Financial factors include fixed assumptions in `scripts/factor_engine.py`, including: ```python if market_cap > 0: debt_ratio = 50 # Assumed 50% debt ratio else: debt_ratio = 0 ``` and: ```python if amount > 0: main_fund_ratio = 0.6 # Assumed 60% institutional funds else: main_fund_ratio = 0 ``` ### Technical Analysis The random forest is not a forward-looking stock prediction model. Its label is a threshold applied to the current-day percentage-change field, while that same field ...[truncated 2102 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill overstates AI/sentiment/daily-pick capabilities that are reportedly absent or only partially implemented, which creates a trust and integrity problem. While this is not direct code execution risk by itself, misrepresentation in an autonomous or semi-autonomous agent can lead users to act on fabricated or incomplete analysis and can mask what the code is actually doing.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill overstates AI/sentiment/daily-pick capabilities that are reportedly absent or only partially implemented, which creates a trust and integrity problem. While this is not direct code execution risk by itself, misrepresentation in an autonomous or semi-autonomous agent can lead users to act on fabricated or incomplete analysis and can mask what the code is actually doing.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md openclaw cron add --name "每日量化选股" --schedule "35 9 * * 1-5" --script scripts/quant-stock-picker-ultimate-integrated.py
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises networked/data-collection behavior and likely environment access through referenced scripts, but the manifest declares no explicit tool scope or permissions boundaries. In an agent setting, missing scope declarations can cause overbroad execution privileges or make review and enforcement of network/env access impossible, increasing the risk of unintended external calls or secret exposure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill content and output are presented in Chinese, and the description is specifically for Chinese A-shares, but there is no explicit user opt-in or statement that the skill is intentionally region/language-specific. Under the policy, forcing a specific language without user choice or clear documented justification is a natural-language policy concern.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases are broad enough to activate on ordinary investing conversation, causing the skill to run in contexts where the user may not have requested automated screening. Overbroad auto-triggering increases the chance of unnecessary network access, data retrieval, or misleading financial recommendations being injected into benign discussions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code performs outbound network requests to third-party sources using stock identifiers without any user-facing notice, consent, or control. In an agent skill, silent external data collection can expose user interests or queried securities to remote services and create privacy, compliance, and transparency risks, especially in financial contexts.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The top-level documentation states the module includes '自编码器因子降维', implying a functioning autoencoder-based dimensionality reduction capability. However, the only autoencoder implementation at L384-L419 defines a network and immediately uses it under torch.no_grad() without training or loading learned weights, so it does not perform meaningful learned reduction as documented.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation says factor screening includes 'IC、IR计算', suggesting both metrics are part of screening behavior. In code, select_factors() accepts ir_threshold but never computes or applies IR, so the documented screening logic materially overstates what the code does.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script globally modifies NO_PROXY, HTTP_PROXY, and HTTPS_PROXY for the process, disabling or bypassing expected proxy controls. In an agent environment, this can undermine network monitoring, policy enforcement, audit controls, or egress restrictions that operators rely on.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Injecting a hard-coded local directory at the front of sys.path changes module resolution and allows imports from an uncontrolled local path to override expected packages. If that directory is writable or compromised, an attacker could achieve arbitrary code execution through malicious module substitution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script fetches external news and social-sentiment data over the network without clearly disclosing that behavior to the user. This creates privacy and policy concerns in restricted environments because stock symbols, timing, and usage patterns may be exposed to third-party services unexpectedly.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script writes a CSV report to a fixed local filesystem path even though the skill is described as a stock-screening tool, not a file-management utility. Unprompted local writes can overwrite prior outputs, leak sensitive analysis artifacts to shared storage, and violate least-privilege expectations for an agent skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script silently saves output to a fixed local path without prior notice or confirmation. In agent contexts, undisclosed persistence can expose investment-related data, overwrite existing files, and violate user expectations about whether the tool leaves artifacts on disk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module docstring and user-facing messages in the file are presented in Chinese only, which effectively forces a specific language for users interacting with the skill. The file does not indicate that language selection is optional or configurable, so it may violate a language/locale policy requiring user choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The primary natural-language documentation and comments describe the module entirely in Chinese, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a locale/language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The script's descriptive text and all user-facing output are written in Chinese, with no indication that the user can select another language. This can violate language/locale policy when a skill imposes a specific language without explicit opt-in or documented justification.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Earlier logic prefers Sina Finance API and only falls back to efinance if Sina fails. The generated report and final disclaimer unconditionally state that the data source is efinance, which contradicts the actual runtime behavior when Sina succeeds.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code may fetch only 500 stocks from Sina, or a different number from efinance, yet the report hard-codes 'efinance（5811只A股）'. This is an active contradiction of the actual behavior and output size computed elsewhere in the script.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script's execution path can use Sina as the primary source and can process varying stock counts, but the disclaimer always states data is based on efinance with 5811 A-shares. This directly conflicts with the earlier runtime behavior and can misrepresent provenance to users.
- Content
Static analysis
No suspicious patterns detected.