AI Risk Assessment

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:38 AM UTC
• Version: 1.0.0

Overview

This is a straightforward Chinese-language investment risk assessment helper with no evidence of hidden control, persistence, credential use, or data exfiltration.

Install in an isolated Python environment and consider pinning dependency versions before use. Treat the position sizing output as an analytical aid, not personalized financial advice, and note that the user-facing text is primarily Chinese.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:43

Finding

Unpinned Third-Party Dependencies Allow Unreviewed Supply-Chain Changes

Content

View full analysis

Vulnerability Details

File Locations: SKILL.md:43-47, skill.json:7
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Low

Vulnerable Code

SKILL.md:43-47:

bash

pip install akshare pandas numpy scipy

skill.json:7:

json

"dependencies": ["akshare", "pandas", "numpy", "scipy"],

Technical Analysis

The project instructs users to install four Python packages without specifying reviewed versions or integrity hashes. The metadata similarly declares only package names. Consequently, package resolution depends on the versions available from the configured package index at installation time.

Python package installation can execute package-controlled build or installation logic. If a future release or transitive dependency is compromised, users may install and execute that code without any change to this project. The absence of a lock file and hashes also prevents reliable verification that an installation uses the dependency artifacts reviewed by the project maintainer.

No evidence was found that the currently named packages are malicious. This finding concerns the project's reproducibility and supply-chain controls rather than a confirmed malicious dependency.

Attack Path

1. An attacker compromises a declared dependency, one of its transitive dependencies, or the package-index account used to publish it.
2. The attacker publishes a malicious release that remains compatible with unconstrained dependency resolution.
3. A user follows the documented pip install command or an agent processes the dependency list.
4. The package manager resolves and downloads the compromised release.
5. Malicious package build or installation logic executes with the privileges of the user performing the installation.
6. The malicious package may subsequently execute again when imported by risk_assessment.py.

This path requires compromise of the package supply chain or pa ...[truncated 575 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed version instead of allowing unrestricted resolution.
2. Generate a lock file that records all transitive dependencies.
3. Require cryptographic hashes for downloaded artifacts, such as by using a hash-locked requirements file and pip install --require-hashes.
4. Install packages only from an explicitly configured, trusted package index or an internally controlled artifact repository.
5. Run dependency vulnerability and provenance checks in CI before publishing the Skill.
6. Review and update pinned versions through a controlled process rather than allowing automatic resolution during installation.
7. Perform installation in an isolated, least-privileged virtual environment or container and avoid installing dependencies as an administrator.
8. Keep skill.json, installation documentation, and the lock file synchronized so all installation paths enforce the same constraints.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill title and all descriptive instructions are written in Chinese, and the file does not indicate that language selection is optional or that the skill is specifically limited to a Chinese-language context. Under the policy, a fixed language or locale without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and function descriptions are presented only in Chinese, and the returned recommendation/interpretation strings are likewise fixed to Chinese. This imposes a specific language on users without any opt-in or documented locale constraint, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description is written entirely in Chinese and provides no indication that the skill supports other languages or that Chinese is a required locale. Under the policy, language constraints should be optional or explicitly justified; here the file gives no opt-in or region-specific rationale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.