A Stock Radar

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:16 AM UTC
• Version: 2.1.1

Overview

The skill is mostly a public A-share market-data tool, but its position guidance can be based on failed or stale data despite documentation claiming that issue was fixed.

Install only if you are comfortable with a Chinese A-share research tool that contacts public market-data providers and gives non-binding position suggestions. Treat its trading guidance as unreliable unless the maintainer fixes the sentiment data freshness/error handling and pins dependencies in a controlled environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/zt_pool.py:1

Finding

Unpinned Third-Party Dependency Installation Guidance

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/sentiment_snapshot.py:49

Finding

Data Retrieval Failures Are Converted into Valid Zero Counts and Used for Position Recommendations

Content

View full analysis

10 and max_board < 3: stage = "冰点" elif limit_ups > 80 and broken_rate < 15 and max_board > 5: stage = "亢奋" elif broken_rate > 25 or (20 <= limit_ups <= 80 and max_board >= 3): stage = "分歧" else: stage = "修复" return { "stage": stage, "position": SENTIMENT_RULES[stage]["position"], "note": SENTIMENT_RULES[stage]["note"], "metrics": { "limit_ups": limit_ups, "limit_downs": limit_downs, "broken_rate": broken_rate, "max_board": max_board, }, } def build_sentiment_snapshot(limit_ups=None, limit_downs=None, broken_boards=None, max_board=None): # 如果没有传入参数，尝试抓真实数据 if all(v is None for v in [limit_ups, limit_downs, broken_boards, max_board]): data = get_sentiment_data() if data is None: return { ...[truncated 3170 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The declared description presents a full-featured A-share monitoring and analysis skill with market breadth, sector activity, capital flow, sentiment analysis, decision framework outputs, and trading/position guidance. The supplied code chunk only retrieves major index spot data from two public market data sources and formats simple price/change strings. While index monitoring is a supporting subset of the declared purpose, the actual code lacks the core analytical, decision, and advisory capabilities described. Therefore the description materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied code chunk is a focused macro data snapshot script, not a full A-share comprehensive monitoring and decision-support tool as described. While it does cover part of the declared scope—specifically macro snapshot elements and northbound funds—it lacks most of the headline functionality in the description, including real-time market overview, sector activity,涨跌情况, emotional indicators, decision framework outputs, and position/trading recommendations. There is no evidence of undeclared harmful behavior, but there is a clear description-versus-behavior mismatch because the primary purpose in this code chunk is much narrower than the declared skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description promises a broad A-share analysis and decision-support tool covering many market dimensions and actionable guidance. The supplied code only retrieves sector涨跌排行 for industry/concept boards from Eastmoney and prints top/bottom performers. There is no evidence of broader market monitoring, macro analysis, sentiment modeling, capital flow analysis, decision framework output, or trading advice generation. While '哪些板块在动' is partially consistent with sector ranking, the actual code is materially narrower than the declared primary purpose, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description presents a high-level A-share market analysis and decision-support tool with multiple analytical dimensions and advisory outputs. The supplied code does not implement those functions. It only queries Sina Finance for one or more explicitly provided stock symbols and formats basic quote information. While real-time quote retrieval is loosely related to stock monitoring, the actual code is far narrower than the declared purpose and lacks nearly all of the described analytical, advisory, and market-wide capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied code is narrowly focused on querying and displaying涨停池/跌停池 data. While this is one small subset of the declared scope ('涨停/跌停'), the description presents the skill as a broad A-share analysis and decision-support tool with multiple analytics and advisory features that are not present in this code chunk. There is no evidence here of macro analysis, market-wide monitoring, sector tracking, northbound capital flow analysis, sentiment framework, or position recommendations. Therefore the code behavior is materially narrower than the declared purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises multiple external-data capabilities and references scripts that would require network and likely shell/code execution, but it does not declare any explicit tool scope such as allowed tools or permissions. This weakens least-privilege controls and can let the runtime grant broader access than reviewers or policy expect, increasing the risk of unintended network or command execution paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes very broad natural-language phrases such as generic market questions and action-oriented prompts like buy/sell or position-sizing advice. Overbroad activation can cause the skill to be invoked in contexts the user did not intend, increasing the chance of unnecessary tool use, incorrect delegation, or finance advice being produced from weak context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The default request headers hard-code "Accept-Language: zh-CN,zh;q=0.9,en;q=0.8", which imposes a locale preference regardless of user settings. This is a natural-language/locale policy concern because the skill does not offer a language choice or document a justified region-specific constraint.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dashboard.py (reported line 17)May include surrounding context.

python

# 1. 主要指数
print("\n>>> 主要指数")
subprocess.run([sys.executable, os.path.join(base, "index_spot.py")])

# 2. 宏观快照
print("\n>>> 宏观快照")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dashboard.py (reported line 21)May include surrounding context.

python

# 2. 宏观快照
print("\n>>> 宏观快照")
subprocess.run([sys.executable, os.path.join(base, "macro_snapshot.py")])

# 3. 核心企业
print("\n>>> A股核心企业")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dashboard.py (reported line 25)May include surrounding context.

python

# 3. 核心企业
print("\n>>> A股核心企业")
subprocess.run([sys.executable, os.path.join(base, "core_companies.py")])

# 4. 行业板块
print("\n>>> 行业涨幅榜TOP10")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dashboard.py (reported line 29)May include surrounding context.

python

# 4. 行业板块
print("\n>>> 行业涨幅榜TOP10")
result = subprocess.run([sys.executable, os.path.join(base, "sector_ranking.py"), "行业板块"], capture_output=True, text=True)
if "暂时不可用" in result.stdout:
    print("（行业板块数据暂时不可用，请稍后重试）")
else:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dashboard.py (reported line 37)May include surrounding context.

python

# 5. 短线情绪
print("\n>>> 短线情绪")
result2 = subprocess.run([sys.executable, os.path.join(base, "sentiment_snapshot.py")], capture_output=True, text=True)
print(result2.stdout, end="")

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module description and all user-facing output strings are in Chinese, indicating the skill is designed to respond in a fixed language/locale. There is no indication that the user can opt into this language or that the locale restriction is explicitly documented as a justified regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module docstring and all user-facing output strings are written only in Chinese, and the skill does not provide any opt-in or alternative language handling. This can violate a language/locale policy when a skill is expected to be usable without forcing a specific language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module docstrings, parameter values, status messages, and CLI output are all hard-coded in Chinese, and the script defaults to Chinese market labels such as '行业板块'. There is no user opt-in, language selection, or documented justification that this skill must operate only in Chinese, which creates a language/locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module description and runtime output are entirely in Chinese, and the script does not provide any option for users to select another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring and all user-facing messages are written only in Chinese, which imposes a specific language on users without any opt-in or stated region-specific justification. Under the policy rule, locale or language constraints should either be optional or explicitly documented as intentional and scoped.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code performs a network request using a caller-provided URL and request headers, which can transmit user or system-derived data to external services. While the function has a technical docstring, there is no user-facing warning, logging, or explicit disclosure about outbound network access in the code shown.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code fetches remote macro/market data via AkShare calls, which are network operations that transmit system-originated requests, but the implementation provides no user-facing notice, confirmation, or inline warning about contacting external data sources. The helper also suppresses stdout/stderr, reducing visibility into these external calls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Natural-language strings throughout the file, including the module description, notes, labels, and CLI output, are fixed in Chinese. This can violate language/locale policy when the skill does not document that it is region-specific or provide a user-selectable language option.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This code automatically calls AkShare data APIs to retrieve live market sentiment inputs, which implies outbound network access. Although comments describe data fetching, there is no confirmation prompt or user-facing disclosure in the code about contacting external data sources when the snapshot is built.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code builds an HTTP request from command-line input and sends it to a third-party Sina Finance endpoint. While the script's purpose is to fetch quotes, there is no explicit user-facing warning, log message, or comment disclosing that supplied codes will be transmitted over the network to an external service.

Content

No source excerpt is available for this finding.