apocdata

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:07 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent A-share market-data connector, but its installation instructions use unverified remote downloads that write into an auto-loaded agent skill directory.

Review before installing. The market-data behavior is read-only and coherent, but avoid the curl | bash path and avoid streaming remote archives directly into your agent skills directory unless you trust the publisher and can verify the exact release contents. Prefer a manually downloaded, pinned, checksum- or signature-verified release, and remove ~/.claude/skills/apocdata if you no longer want it auto-loaded.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:64

Finding

Remote installation script is piped directly into Bash

Content

View full analysis

Remediation

View remediation

install.sh" | sha256sum --check - ``` 5. Prefer cryptographic release signatures, such as Sigstore or GPG signatures, over checksums alone. 6. Instruct users to inspect the downloaded script before running it. 7. Pin downloads to immutable release artifacts rather than relying only on repository tags. 8. Use `curl --fail --show-error` so HTTP error pages or unexpected responses are not silently treated as executable shell input. ]]>

T08 · Insecure Dependencies

Error

• Location: README.md:56

Finding

Unverified remote archive is extracted into an automatically loaded Skill directory

Content

View full analysis

Remediation

View remediation

apocdata-v2.0.0.tar.gz" | sha256sum --check - ``` 6. Extract into a newly created temporary directory with restrictive permissions. 7. Validate an explicit manifest of permitted paths and reject unexpected files, symbolic links, absolute paths, path traversal entries, executables, or additional scripts. 8. Verify the expected hashes of `SKILL.md` and every reference file. 9. Atomically replace the destination only after all validation succeeds. 10. Avoid extracting over an existing Skill directory, because obsolete or attacker-added files may otherwise remain present. 11. Constrain or remove the `APOCDATA_VERSION` override unless arbitrary version installation is explicitly required. 12. Update all installation instructions in `README.md`, `SKILL.md`, `CHANGELOG.md`, and `scripts/install.sh` so they consistently use the verified installation procedure. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | bash construct is a classic dangerous execution chain because it turns untrusted network content directly into shell commands with no validation barrier. In the context of a skill install path, this creates a high-likelihood route to arbitrary code execution and persistent compromise of the agent environment if the upstream content is tampered with.

Content

Scanner excerpt · README.md (reported line 67)May include surrounding context.

Alternative: install script

bash

curl -sL https://raw.githubusercontent.com/ApocData/ApocData-skill/v2.0.0/scripts/install.sh | bash

---

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is stock-data retrieval via the ApocData API, but the documented behavior includes downloading an archive from GitHub, extracting it locally, and bootstrapping files into the user's skill directory. That mismatch is dangerous because users and orchestration systems may trust the skill as a simple data connector while it actually performs code/content installation and persistent local changes, increasing supply-chain and execution risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared purpose is stock-data retrieval via the ApocData API, but the documented behavior includes downloading an archive from GitHub, extracting it locally, and bootstrapping files into the user's skill directory. That mismatch is dangerous because users and orchestration systems may trust the skill as a simple data connector while it actually performs code/content installation and persistent local changes, increasing supply-chain and execution risk.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | bash chain causes remotely retrieved content to be executed immediately in a shell, turning any upstream compromise or content substitution into instant arbitrary command execution. In the context of a skill installer, this is more dangerous because users are being asked to install code locally under their home directory, so trust in the installation path can normalize unsafe execution habits.

Content

Scanner excerpt · scripts/install.sh (reported line 3)May include surrounding context.

sh

#!/usr/bin/env bash
# ApocData Skill — one-line installer
# Usage: curl -sL https://raw.githubusercontent.com/ApocData/ApocData-skill/v2.0.0/scripts/install.sh | bash
set -euo pipefail

VERSION="${APOCDATA_VERSION:-v2.0.0}"

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · CHANGELOG.md (reported line 38)May include surrounding context.

bash

# Old (v1.x, single file) — no longer recommended
curl -L --fail -o ~/.claude/skills/apocdata/SKILL.md \
  https://raw.githubusercontent.com/ApocData/ApocData-skill/v1.1.0/SKILL.md

# New (v2.x, multi-file) — recommended

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.zh-CN.md (reported line 60)May include surrounding context.

bash

# Old (v1.x, single file) — no longer recommended
curl -L --fail -o ~/.claude/skills/apocdata/SKILL.md \
  https://raw.githubusercontent.com/ApocData/ApocData-skill/v1.1.0/SKILL.md

# New (v2.x, multi-file) — recommended

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.zh-CN.md (reported line 77)May include surrounding context.

bash

# Old (v1.x, single file) — no longer recommended
curl -L --fail -o ~/.claude/skills/apocdata/SKILL.md \
  https://raw.githubusercontent.com/ApocData/ApocData-skill/v1.1.0/SKILL.md

# New (v2.x, multi-file) — recommended

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CHANGELOG.md (reported line 42)May include surrounding context.

https://raw.githubusercontent.com/ApocData/ApocData-skill/v1.1.0/SKILL.md

New (v2.x, multi-file) — recommended

mkdir -p ~/.claude/skills/apocdata curl -sL https://github.com/ApocData/ApocData-skill/archive/refs/tags/v2.0.0.tar.gz
| tar xz -C ~/.claude/skills/apocdata --strip-components=1

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

https://raw.githubusercontent.com/ApocData/ApocData-skill/v1.1.0/SKILL.md

New (v2.x, multi-file) — recommended

mkdir -p ~/.claude/skills/apocdata curl -sL https://github.com/ApocData/ApocData-skill/archive/refs/tags/v2.0.0.tar.gz
| tar xz -C ~/.claude/skills/apocdata --strip-components=1

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README instructs users to fetch remote content and execute it immediately via a shell pipeline, without any integrity verification, signature check, or explicit warning. If the remote source, transport path, or referenced script content is ever compromised, users could execute arbitrary code on their machine with their current user privileges.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.zh-CN.md (reported line 59)May include surrounding context.

bash

# 固定版本 v1.1.0，查看最新版本: https://github.com/ApocData/ApocData-skill/releases
mkdir -p ~/.claude/skills/apocdata
curl -o ~/.claude/skills/apocdata/SKILL.md \
  https://raw.githubusercontent.com/ApocData/ApocData-skill/v1.1.0/SKILL.md

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises operational behaviors that require shell, filesystem read/write, and installation steps, but it does not declare any explicit tool scope or permissions boundaries. This creates an undeclared capability surface: an agent may invoke local shell and persistent file modifications without users realizing the skill can alter the environment beyond fetching stock data.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · CHANGELOG.md (reported line 42)May include surrounding context.

bash

# v2.0.0 多文件结构（推荐）
mkdir -p ~/.claude/skills/apocdata
curl -sL https://github.com/ApocData/ApocData-skill/archive/refs/tags/v2.0.0.tar.gz \
  | tar xz -C ~/.claude/skills/apocdata --strip-components=1

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

bash

# v2.0.0 多文件结构（推荐）
mkdir -p ~/.claude/skills/apocdata
curl -sL https://github.com/ApocData/ApocData-skill/archive/refs/tags/v2.0.0.tar.gz \
  | tar xz -C ~/.claude/skills/apocdata --strip-components=1

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.zh-CN.md (reported line 59)May include surrounding context.

bash

# v2.0.0 多文件结构（推荐）
mkdir -p ~/.claude/skills/apocdata
curl -sL https://github.com/ApocData/ApocData-skill/archive/refs/tags/v2.0.0.tar.gz \
  | tar xz -C ~/.claude/skills/apocdata --strip-components=1

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.zh-CN.md (reported line 76)May include surrounding context.

bash

# v2.0.0 多文件结构（推荐）
mkdir -p ~/.claude/skills/apocdata
curl -sL https://github.com/ApocData/ApocData-skill/archive/refs/tags/v2.0.0.tar.gz \
  | tar xz -C ~/.claude/skills/apocdata --strip-components=1

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

bash

# v2.0.0 多文件结构（推荐）
mkdir -p ~/.claude/skills/apocdata
curl -sL https://github.com/ApocData/ApocData-skill/archive/refs/tags/v2.0.0.tar.gz \
  | tar xz -C ~/.claude/skills/apocdata --strip-components=1

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The installation command writes files into a persistent per-user directory under ~/.claude/skills, causing the skill to survive the current session and affect future agent behavior. Persistent modification is risky in skill context because any compromised or unreviewed content fetched from a remote archive can remain active across sessions and be re-used without fresh consent.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

bash

# v2.0.0 多文件结构（推荐）
mkdir -p ~/.claude/skills/apocdata
curl -sL https://github.com/ApocData/ApocData-skill/archive/refs/tags/v2.0.0.tar.gz \
  | tar xz -C ~/.claude/skills/apocdata --strip-components=1

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The header X-Tdc-Coverage-Reason is described as providing a Chinese explanation (稀疏原因中文说明). This imposes a specific language/locale in the skill's documented behavior without any opt-in or alternative language path, which matches the policy-violation category for forced language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The entire skill example content is written in Chinese, including headings, trigger examples, and guidance, with no indication that other languages are supported or that Chinese is optional. This can violate language/locale policy when a skill effectively requires a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file is entirely written in Chinese and all example prompts are Chinese-only, which effectively forces a specific language for users. The policy allows locale constraints only when the skill offers opt-in or clearly documents a justified region-specific limitation, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The entire skill reference, including headings, descriptions, and example questions, is written only in Chinese with no indication that users may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The entire skill description, headings, and example questions are written only in Chinese, with no indication that users may interact in other languages or that the skill is intentionally restricted to a Chinese-speaking audience. Under the policy, imposing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example trigger phrases are broad enough to match generic user requests such as '全面分析一下平安银行' or '帮我看下 688017 怎么样', which can cause the skill to activate outside a clearly bounded A-share data intent. In an agent environment, overbroad triggers can lead to incorrect tool selection, unnecessary external API calls, and leakage of user prompts or context to the wrong integration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file is entirely written as mandatory behavior rules in Chinese and repeatedly states that all agents using this skill must comply. There is no indication that users may choose another language or that the Chinese-only constraint is a documented region-specific requirement, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.