ApocData A股数据

• Outcome: Review
• Latest audit: Aug 24, 2026 · 7:19 AM UTC
• Version: 2.0.2

Overview

The skill's market-data behavior is read-only and coherent, but its installation instructions use unsafe remote shell/archive patterns that can alter local agent files without integrity checks.

Review the release contents before installing, avoid the curl | bash installer, and prefer a downloaded archive or package with an independently checked checksum or signature. The skill itself uses public no-auth market data endpoints, but installing it changes local agent behavior under ~/.claude/skills, and its financial outputs should be treated as research only, not investment advice.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill documentation includes shell commands that download and extract content from a remote GitHub archive into the local skills directory, which implies shell execution plus file write capability without any declared permissions boundary. In a skill ecosystem, undeclared install-time write and shell behavior increases supply-chain risk because users may treat the skill as passive documentation/API usage when it can alter the local environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The declared purpose is a read-only A-share data skill, but the analysis indicates additional behaviors such as downloading/installing repository contents, performing endpoint health checks, and modifying README metadata. That mismatch is dangerous because it can mislead users and security controls about the skill’s true operational scope, enabling unexpected network activity and local file modification under the guise of a harmless market-data integration.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README recommends a one-line shell pipeline that downloads a remote script and immediately executes it via `bash`. This bypasses review of the downloaded content and creates a supply-chain execution risk if the GitHub source, tag, network path, or hosting account is compromised. In the context of an AI skill, users may copy-paste installation commands with less scrutiny, which makes this pattern more dangerous than ordinary documentation text.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The installer downloads a remote tarball and extracts it directly into the user's skill directory, modifying local files without integrity verification, confirmation, or a safe staging step. If the tag is changed upstream, the network path is intercepted, or a user overrides APOCDATA_VERSION to an unexpected value, this could overwrite installed skill contents with untrusted data.

External Script Fetching

Low

• Category: Supply Chain

Content

#!/usr/bin/env bash
# ApocData Skill — one-line installer
# Usage: curl -sL https://raw.githubusercontent.com/ApocData/ApocData-skill/v2.0.0/scripts/install.sh | bash
set -euo pipefail

VERSION="${APOCDATA_VERSION:-v2.0.0}"

• Confidence: 95% confidence
• Finding: The documented installation method instructs users to fetch a shell script over the network and immediately execute it with bash, eliminating an opportunity for review and making any compromise of the source, redirect, or transport highly dangerous. This is a classic unsafe installation pattern because trust is placed entirely in live remote content at execution time.

Chaining Abuse

High

• Category: Tool Misuse

Content

#!/usr/bin/env bash
# ApocData Skill — one-line installer
# Usage: curl -sL https://raw.githubusercontent.com/ApocData/ApocData-skill/v2.0.0/scripts/install.sh | bash
set -euo pipefail

VERSION="${APOCDATA_VERSION:-v2.0.0}"

• Confidence: 98% confidence
• Finding: The `| bash` pattern is especially dangerous because it executes whatever bytes are returned by the remote endpoint without inspection, allowing immediate arbitrary code execution in the user's shell context. In this skill context, the installer is intended to run on developer machines and write into a local Claude skills directory, so a compromised script could alter local files, persist malicious content, or pivot to broader user-level compromise.

Static analysis

No suspicious patterns detected.