ApocData A股数据

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:13 AM UTC
• Version: 2.0.2

Overview

The skill mainly provides read-only A-share market data, but some setup paths can run or install downloaded code without verification.

Review the install path before use. Prefer installing the reviewed artifact through a trusted package channel, or download archives/scripts to disk, inspect them, and verify published checksums or signatures before placing files under ~/.claude/skills. Avoid the curl-to-bash path, and pin or audit the MCP server package before enabling it. The ApocData API calls themselves are described as read-only and unauthenticated, but financial outputs should still be treated as research, not investment advice.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:138

Finding

Remote Installer Is Executed Directly Through a curl-to-Bash Pipeline

Content

View full analysis

Remediation

View remediation

' install.sh | sha256sum --check - ``` 4. Prefer a cryptographically signed release artifact and document signature verification. 5. Instruct users to inspect the downloaded script before running it. 6. Prefer a non-executable installation process that copies verified Markdown files into the Skill directory. 7. Make network failures explicit by using `curl --fail`; avoid silent options that conceal useful errors. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:12

Finding

Unverified Remote Archives Are Extracted Directly into an Auto-Loaded Agent Skill Directory

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: README.md:117

Finding

Unpinned MCP Package Is Automatically Downloaded and Executed by npx

Content

View full analysis

Remediation

View remediation

"] } ``` 2. Prefer a locally installed dependency governed by a committed lockfile with registry integrity hashes. 3. Publish and verify package provenance, release signatures, and reproducible build information. 4. Audit the MCP server package and its complete transitive dependency tree before recommending it. 5. Disable or restrict package lifecycle scripts during installation where operationally possible. 6. Run the MCP server in a sandbox with minimum filesystem, environment, process, and network access. 7. Do not expose unrelated credentials or sensitive environment variables to the MCP process. 8. Establish an explicit update and re-audit process rather than silently accepting newly published versions. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Piping curl output directly into bash creates an immediate arbitrary command execution path with no validation barrier. In the context of an AI agent skill README, this is more dangerous because users may copy-paste installation commands with elevated trust, making exploitation via upstream compromise or content substitution more likely.

Content

Scanner excerpt · README.md (reported line 141)May include surrounding context.

Alternative: install script

bash

curl -sL https://raw.githubusercontent.com/ApocData/ApocData-skill/v2.0.0/scripts/install.sh | bash

---

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is market-data assistance, but the document also instructs downloading an archive from GitHub and extracting it into the local skill directory. That behavior expands the trust boundary from public API usage to remote code/content installation, which can introduce unreviewed files, overwrite local state, or persist attacker-controlled content under the agent's skill path.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The '| bash' pattern is a direct command-chaining mechanism that turns remote content into immediately executed shell commands, eliminating any opportunity for review or validation. In a skill installer context, this is especially dangerous because installation is expected behavior, making users more likely to run it and thereby amplifying supply-chain compromise impact.

Content

Scanner excerpt · scripts/install.sh (reported line 3)May include surrounding context.

sh

#!/usr/bin/env bash
# ApocData Skill — one-line installer
# Usage: curl -sL https://raw.githubusercontent.com/ApocData/ApocData-skill/v2.0.0/scripts/install.sh | bash
set -euo pipefail

VERSION="${APOCDATA_VERSION:-v2.0.0}"

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · CHANGELOG.md (reported line 38)May include surrounding context.

bash

# Old (v1.x, single file) — no longer recommended
curl -L --fail -o ~/.claude/skills/apocdata/SKILL.md \
  https://raw.githubusercontent.com/ApocData/ApocData-skill/v1.1.0/SKILL.md

# New (v2.x, multi-file) — recommended

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CHANGELOG.md (reported line 42)May include surrounding context.

https://raw.githubusercontent.com/ApocData/ApocData-skill/v1.1.0/SKILL.md

New (v2.x, multi-file) — recommended

mkdir -p ~/.claude/skills/apocdata curl -sL https://github.com/ApocData/ApocData-skill/archive/refs/tags/v2.0.0.tar.gz
| tar xz -C ~/.claude/skills/apocdata --strip-components=1

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 110)May include surrounding context.

https://raw.githubusercontent.com/ApocData/ApocData-skill/v1.1.0/SKILL.md

New (v2.x, multi-file) — recommended

mkdir -p ~/.claude/skills/apocdata curl -sL https://github.com/ApocData/ApocData-skill/archive/refs/tags/v2.0.0.tar.gz
| tar xz -C ~/.claude/skills/apocdata --strip-components=1

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.zh-CN.md (reported line 109)May include surrounding context.

https://raw.githubusercontent.com/ApocData/ApocData-skill/v1.1.0/SKILL.md

New (v2.x, multi-file) — recommended

mkdir -p ~/.claude/skills/apocdata curl -sL https://github.com/ApocData/ApocData-skill/archive/refs/tags/v2.0.0.tar.gz
| tar xz -C ~/.claude/skills/apocdata --strip-components=1

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.zh-CN.md (reported line 125)May include surrounding context.

https://raw.githubusercontent.com/ApocData/ApocData-skill/v1.1.0/SKILL.md

New (v2.x, multi-file) — recommended

mkdir -p ~/.claude/skills/apocdata curl -sL https://github.com/ApocData/ApocData-skill/archive/refs/tags/v2.0.0.tar.gz
| tar xz -C ~/.claude/skills/apocdata --strip-components=1

text

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill content includes shell commands, local file writes, and reads of reference files, but the manifest declares no explicit tool scope or allowed-tools boundaries. That creates an authorization ambiguity where an agent may execute broader capabilities than users expect, increasing the risk of unintended filesystem or shell access.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · CHANGELOG.md (reported line 42)May include surrounding context.

bash

# v2.0.0 多文件结构（推荐）
mkdir -p ~/.claude/skills/apocdata
curl -sL https://github.com/ApocData/ApocData-skill/archive/refs/tags/v2.0.0.tar.gz \
  | tar xz -C ~/.claude/skills/apocdata --strip-components=1

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 110)May include surrounding context.

bash

# v2.0.0 多文件结构（推荐）
mkdir -p ~/.claude/skills/apocdata
curl -sL https://github.com/ApocData/ApocData-skill/archive/refs/tags/v2.0.0.tar.gz \
  | tar xz -C ~/.claude/skills/apocdata --strip-components=1

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.zh-CN.md (reported line 109)May include surrounding context.

bash

# v2.0.0 多文件结构（推荐）
mkdir -p ~/.claude/skills/apocdata
curl -sL https://github.com/ApocData/ApocData-skill/archive/refs/tags/v2.0.0.tar.gz \
  | tar xz -C ~/.claude/skills/apocdata --strip-components=1

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.zh-CN.md (reported line 125)May include surrounding context.

bash

# v2.0.0 多文件结构（推荐）
mkdir -p ~/.claude/skills/apocdata
curl -sL https://github.com/ApocData/ApocData-skill/archive/refs/tags/v2.0.0.tar.gz \
  | tar xz -C ~/.claude/skills/apocdata --strip-components=1

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

bash

# v2.0.0 多文件结构（推荐）
mkdir -p ~/.claude/skills/apocdata
curl -sL https://github.com/ApocData/ApocData-skill/archive/refs/tags/v2.0.0.tar.gz \
  | tar xz -C ~/.claude/skills/apocdata --strip-components=1

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill instructs writing into ~/.claude/skills, creating persistent local state that survives the current session. In the context of an agent skill, persistence is risky because any remote-fetched content placed in that directory can remain active across future runs, enabling long-lived modification of agent behavior or supply-chain style persistence.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

bash

# v2.0.0 多文件结构（推荐）
mkdir -p ~/.claude/skills/apocdata
curl -sL https://github.com/ApocData/ApocData-skill/archive/refs/tags/v2.0.0.tar.gz \
  | tar xz -C ~/.claude/skills/apocdata --strip-components=1

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The title explicitly states the skill is a Chinese compact version for small models, and the document is entirely written in Chinese without indicating that language choice is optional. This can violate language/locale policy when a user has not opted into Chinese output or when the surrounding system expects language flexibility.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Line L054 states that X-Tdc-Coverage-Reason provides the sparse-data reason in Chinese (中文说明). This is a natural-language locale constraint presented as required behavior, and the file does not indicate any user choice, fallback, or opt-in for other languages.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file is entirely written as mandatory behavior rules in Chinese and requires every output to include a specific Chinese disclaimer. This can constitute a language/locale policy violation because it appears to force a specific language for agent output without user opt-in or an explicit justification that the skill is limited to a Chinese-language or region-specific workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Line L30 explicitly states that the YAML description was enhanced with Chinese trigger keywords. Because this file provides no indication that users can choose language or that the locale restriction is justified, it suggests a language-specific behavior that may conflict with organizational language/locale policy expectations.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The README instructs users to fetch and execute a remote shell script directly from the network. This is dangerous because the script content is not reviewed locally before execution, and any compromise of the GitHub account, tag, hosting path, or supply chain could lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · README.md (reported line 141)May include surrounding context.

Alternative: install script

bash

curl -sL https://raw.githubusercontent.com/ApocData/ApocData-skill/v2.0.0/scripts/install.sh | bash

---

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

该文件以中文为主，并在语言切换区将“简体中文”作为当前固定展示语言。虽然同时提供了 English 链接，但文档内容本身未说明可根据用户偏好选择语言，可能被理解为默认强制特定语言。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file's headings, trigger examples, and usage guidance are entirely in Chinese, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file’s headings, descriptions, examples, and usage guidance are entirely in Chinese, which imposes a specific language on users without any stated opt-in or alternative. Under the policy, forced language/locale behavior is a natural-language policy concern unless the skill explicitly offers a choice or clearly justifies the restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown skill reference presents all instructions, examples, and descriptions exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale policy issue when no alternative or choice is documented.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

A language/locale policy issue applies to all file types when a skill forces a specific language without user opt-in. This reference material presents all instructions, examples, and descriptions only in Chinese, with no indication that users may choose another language or that the content is intentionally limited to a Chinese-language audience.

Content

No source excerpt is available for this finding.