Security audit

allstock-data

Security checks for vulnerabilities and agentic risk

Overview

This stock-data skill is coherent and disclosed, with notable but manageable risks from unencrypted market-data requests and an optional unpinned Python package install.

Install only if you are comfortable with stock symbols being sent to third-party data providers. Avoid relying on the HTTP quote examples for trading or high-stakes decisions without checking against a trusted HTTPS source, and install adata in an isolated environment with a pinned version if you use it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:168
Finding: Unpinned Third-Party Package Installation Creates Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
" ``` 2. Obtain the package from its verified official source and document the expected publisher and repository. 3. Download and review the exact distribution artifact before recommending it. 4. Record cryptographic hashes in a requirements file and enforce them: ```text adata== --hash=sha256: ``` ```bash python -m pip install --require-hashes -r requirements.txt ``` 5. Pin and hash all transitive dependencies using a lockfile or reproducible dependency-management process. 6. Install the package in an isolated virtual environment or container under an unprivileged account. 7. Add automated dependency vulnerability, provenance, and integrity checks to the release-review process. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:21
Finding: Financial Market Queries Use Unencrypted HTTP Transport
Content: View full analysis
``` **Examples:** ```bash # Single stock curl -s "http://qt.gtimg.cn/q=sh600519" # Multiple stocks curl -s "http://qt.gtimg.cn/q=sh600519,sh000001,sz399001" ``` ``` The same plaintext endpoint is also prescribed for Hong Kong quotes, US quotes, and order-book analysis: ```bash curl -s "http://qt.gtimg.cn/q=hk00700" curl -s "http://qt.gtimg.cn/q=usAAPL" curl -s "http://qt.gtimg.cn/q=s_pksh600519" ``` ### Technical Analysis The documented quote and order-book requests use HTTP instead of authenticated HTTPS. HTTP provides neither transport confidentiality nor server authentication and does not protect response integrity. An attacker able to observe or modify traffic—such as a hostile Wi-Fi operator, compromised router, malicious proxy, ISP-level intermediary, or other on-path actor—can identify requested instruments and alter returned market information. Because the Skill directs the Agent to consume these responses as stock data, a modified response could be treated as a legitimate quote or order-book result. The project separately uses HTTPS for historical K-line requests, but that does not protect the quote and order-book requests sent to the HTTP endpoint. ### Attack Path 1. A user or Agent follows the Skill and sends a quote request to `http://qt.gtimg.cn`. 2. An attacker obtains an on-path network position. 3. The attacker intercepts the plaintext request and learns which stock or index is being queried. 4. The attacker modifies or replaces the HTTP response with fabricated prices, changes, volume figures, or order-book ratios. 5. The Agent parses or reports the forged response as if it came intact from the intended provider. 6. The user or a downstream workflow makes an an ...[truncated 598 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The examples rely on plaintext HTTP endpoints for quote and order-book requests, which allows intermediaries on the network path to observe or tamper with responses. In a financial-data skill, altered market data could mislead downstream analysis or decisions, and unencrypted requests also leak the queried instruments and usage behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs users to query third-party market data services but does not warn that requested stock symbols and timing metadata are disclosed to Tencent or other providers. While stock symbols are usually not highly sensitive, user queries can still reveal trading interests, research activity, or organizational focus, so the omission is a real privacy weakness rather than a false positive.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.