Security audit
Security checks for vulnerabilities and agentic risk
This stock-analysis skill is coherent in purpose, but it needs Review because its remote data-update path sends tokens over HTTP and imports remotely supplied files in unsafe ways that could expose credentials or run code if compromised.
Install only if you trust the BitSoul service and are comfortable giving it a token. Before use, the publisher should switch all token-bearing endpoints to HTTPS, remove pickle support for remote patches, add signed/digest-verified manifests, safely extract archives, remove the hard-coded token, disable or redact detailed logs by default, and make retraining/cache-clearing actions explicit and reversible.
scripts/data_fetcher.py:1694Remote patch processing permits arbitrary code execution through untrusted pickle deserialization
assets/config.json:3Authentication tokens and decryption credentials are transmitted over plaintext HTTP
scripts/utils.py:46Remote archives are extracted without path traversal validation
scripts/remote_api.py:182Credential-like API token is hard-coded in executable source code
scripts/stock_api.py:222Persistent default logging records sensitive portfolio and trading parameters
assets/requirements.txt:1Dependency specifications permit installation of future unaudited releases
The reported behavior includes patch-list retrieval, version checking, requests for decryption keys and download URLs, token validation, and submission of收益/持仓排行榜 data to a server—capabilities materially different from a simple stock-analysis skill. This is dangerous because it introduces remote update and outbound data submission pathways that can expose user data, enable opaque content delivery, and exceed user expectations for the granted token and network access.
The reported behavior includes patch-list retrieval, version checking, requests for decryption keys and download URLs, token validation, and submission of收益/持仓排行榜 data to a server—capabilities materially different from a simple stock-analysis skill. This is dangerous because it introduces remote update and outbound data submission pathways that can expose user data, enable opaque content delivery, and exceed user expectations for the granted token and network access.
The reported behavior includes patch-list retrieval, version checking, requests for decryption keys and download URLs, token validation, and submission of收益/持仓排行榜 data to a server—capabilities materially different from a simple stock-analysis skill. This is dangerous because it introduces remote update and outbound data submission pathways that can expose user data, enable opaque content delivery, and exceed user expectations for the granted token and network access.
The reported behavior includes patch-list retrieval, version checking, requests for decryption keys and download URLs, token validation, and submission of收益/持仓排行榜 data to a server—capabilities materially different from a simple stock-analysis skill. This is dangerous because it introduces remote update and outbound data submission pathways that can expose user data, enable opaque content delivery, and exceed user expectations for the granted token and network access.
The reported behavior includes patch-list retrieval, version checking, requests for decryption keys and download URLs, token validation, and submission of收益/持仓排行榜 data to a server—capabilities materially different from a simple stock-analysis skill. This is dangerous because it introduces remote update and outbound data submission pathways that can expose user data, enable opaque content delivery, and exceed user expectations for the granted token and network access.
The reported behavior includes patch-list retrieval, version checking, requests for decryption keys and download URLs, token validation, and submission of收益/持仓排行榜 data to a server—capabilities materially different from a simple stock-analysis skill. This is dangerous because it introduces remote update and outbound data submission pathways that can expose user data, enable opaque content delivery, and exceed user expectations for the granted token and network access.
The reported behavior includes patch-list retrieval, version checking, requests for decryption keys and download URLs, token validation, and submission of收益/持仓排行榜 data to a server—capabilities materially different from a simple stock-analysis skill. This is dangerous because it introduces remote update and outbound data submission pathways that can expose user data, enable opaque content delivery, and exceed user expectations for the granted token and network access.
The reported behavior includes patch-list retrieval, version checking, requests for decryption keys and download URLs, token validation, and submission of收益/持仓排行榜 data to a server—capabilities materially different from a simple stock-analysis skill. This is dangerous because it introduces remote update and outbound data submission pathways that can expose user data, enable opaque content delivery, and exceed user expectations for the granted token and network access.
The reported behavior includes patch-list retrieval, version checking, requests for decryption keys and download URLs, token validation, and submission of收益/持仓排行榜 data to a server—capabilities materially different from a simple stock-analysis skill. This is dangerous because it introduces remote update and outbound data submission pathways that can expose user data, enable opaque content delivery, and exceed user expectations for the granted token and network access.
The reported behavior includes patch-list retrieval, version checking, requests for decryption keys and download URLs, token validation, and submission of收益/持仓排行榜 data to a server—capabilities materially different from a simple stock-analysis skill. This is dangerous because it introduces remote update and outbound data submission pathways that can expose user data, enable opaque content delivery, and exceed user expectations for the granted token and network access.
The reported behavior includes patch-list retrieval, version checking, requests for decryption keys and download URLs, token validation, and submission of收益/持仓排行榜 data to a server—capabilities materially different from a simple stock-analysis skill. This is dangerous because it introduces remote update and outbound data submission pathways that can expose user data, enable opaque content delivery, and exceed user expectations for the granted token and network access.
A hardcoded token appears directly in the source, which risks credential leakage through source distribution, logs, screenshots, or repository history. If the token is valid, anyone obtaining the code may be able to access protected APIs or impersonate the application/user.
The skill advertises environment access, file access, and network use in metadata but does not declare explicit tool scoping such as permissions or allowed-tools. That increases the attack surface because an agent may grant broader capabilities than users expect, especially given the skill also references local env-file reading, caching, initialization scripts, and remote API access.
This markdown file defines activation phrases such as “挖矿”, “碰碰运气”, and “随机推荐”, which are common conversational expressions and not specific to this stock-analysis skill. Such broad phrasing could cause unintended invocation because the boundaries of when the skill should activate versus not activate are not clearly constrained.
The instruction “默认使用简体中文” imposes a language/locale choice in the skill behavior without indicating user choice or opt-in. This is a natural-language policy concern because it fixes the interaction language rather than offering or detecting the user's preferred language.
The skill defines mandatory invocation of a random factor mining/backtest function based on broad natural-language triggers such as '随机推荐' and '碰碰运气'. This can cause unintended tool execution and strategy generation from casual user phrasing, reducing user control and potentially producing financial-analysis actions the user did not explicitly authorize.
The MoE weight training trigger is described with vague phrases like '优化权重' or '适配最新行情', which may match broad requests that do not clearly consent to retraining. Because training is computationally significant and changes future model behavior, ambiguous triggering can lead to unintended execution and state-changing side effects.
The documentation states that training automatically writes optimized weights to 'moe_weights.json' for future use, but does not require warning or confirmation before persistent local modification. Silent state persistence is dangerous because it changes subsequent outputs across sessions and can be abused to poison or unexpectedly alter model behavior.
The cache-clearing functions can delete local indicator cache data, including all cached data, without any documented warning, confirmation, or safety guard. In an agent setting, destructive maintenance operations exposed without friction can lead to accidental data loss, degraded performance, or disruption of later analyses.
The module-level documentation states '纯函数，无副作用' on L011, which means pure functions with no side effects. However, update_position mutates the Position object in place (L152), and buy/sell explicitly mutate the positions dictionary in place as documented and implemented (L340, L409, L373-L381, L447-L455), directly contradicting the stated design principle.
The manifest describes market-data, stock screening, indicators, backtesting, and related analytics features, but it does not mention authentication or account-bound access. This file implements secret retrieval from both process environment and a caller-specified file path, which is a broader capability than the stated all-in-one stock analysis functionality itself justifies.
The top-level docstring is entirely in Chinese and presents the module description only in that language, with no indication that users can choose another language or that the locale is intentionally restricted. Under the stated policy, imposing a specific language without opt-in is a natural-language locale policy concern.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
from sqlalchemy import create_engine, text, Engine
from typing import List, Optional
from define import BASE_URL, HTTP_TIMEOUT, DB_PATH, StockBasic, DailyKline, HourKline, WeeklyKline, MonthlyKline, DailyBasic, Income, StockLimit, DailyLimitList, DailyBombList, SectorStockMap, TopList, TopInst, SectorFlowDaily, IndexBasic, IndexDaily, IndexWeekly, IndexMonthly
import utils
from logger import log
import config
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
from sqlalchemy import create_engine, text, Engine
from typing import List, Optional
from define import BASE_URL, HTTP_TIMEOUT, DB_PATH, StockBasic, DailyKline, HourKline, WeeklyKline, MonthlyKline, DailyBasic, Income, StockLimit, DailyLimitList, DailyBombList, SectorStockMap, TopList, TopInst, SectorFlowDaily, IndexBasic, IndexDaily, IndexWeekly, IndexMonthly
import utils
from logger import log
import config
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
from sqlalchemy import create_engine, text, Engine
from typing import List, Optional
from define import BASE_URL, HTTP_TIMEOUT, DB_PATH, StockBasic, DailyKline, HourKline, WeeklyKline, MonthlyKline, DailyBasic, Income, StockLimit, DailyLimitList, DailyBombList, SectorStockMap, TopList, TopInst, SectorFlowDaily, IndexBasic, IndexDaily, IndexWeekly, IndexMonthly
import utils
from logger import log
import config
No suspicious patterns detected.