股票实时行情分析器(安全版)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:34 AM UTC
• Version: 1.0.0

Overview

The skill mostly does what it claims, but its email and credential handling need careful review before use.

Use this only in an isolated environment, review or fix send_email.py before sending reports, avoid passing email passwords or authorization codes as command-line arguments, and assume report contents plus recipient details are sent to external email providers. Be aware that jq_login.py stores the JoinQuant phone/account identifier locally, even though it does not store the password.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Unpinned and Unverified Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: scripts/requirements.txt:1-4; installation instruction at SKILL.md:15
Vulnerability Type: Supply-chain risk from mutable dependency resolution
Risk Level: Medium

Vulnerable Code

text

akshare>=1.10.0
jqdatasdk>=1.8.0
pandas>=1.5.0
requests>=2.28.0

The dependencies are installed using the following instruction:

bash

pip install -r scripts/requirements.txt

Technical Analysis

All four dependencies use open-ended lower-bound constraints. There is no lockfile, exact version pinning, package hash verification, or documented trusted package index. Consequently, identical installation commands can resolve to different code over time.

Python package installation may execute package-controlled build or installation logic. If a permitted dependency or one of its transitive dependencies is compromised, a future installation could execute attacker-controlled code even though the audited project files remain unchanged.

This finding does not establish that any currently named package is malicious. It identifies a mutable and insufficiently verified software supply chain.

Attack Path

1. An attacker compromises the publication account, distribution artifact, or transitive dependency of an allowed package.
2. The attacker publishes a malicious version that still satisfies the project's lower-bound constraint.
3. A user follows SKILL.md and runs the documented pip install command.
4. Pip resolves the malicious version because no exact version or expected hash is enforced.
5. Malicious installation or runtime code executes with the privileges of the user running the Skill.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The resulting access could include project files, environment variables, JoinQuant credentials, SMTP credentials, network access, and any other r ...[truncated 179 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace lower-bound constraints with exact, reviewed versions.
2. Generate and commit a reproducible lockfile that includes transitive dependencies.
3. Record and enforce artifact hashes, such as by installing with pip --require-hashes.
4. Install only from an explicitly configured and trusted package index.
5. Review dependency changes before updating locked versions.
6. Run dependency installation and the Skill in an isolated virtual environment or container with minimal filesystem and credential access.
7. Add automated vulnerability and package-integrity scanning to the update process.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send_email.py:110

Finding

SMTP Credentials Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/send_email.py:110-127; unsafe usage examples at scripts/send_email.py:15-16 and SKILL.md:63
Vulnerability Type: Sensitive credentials accepted through the process argument vector
Risk Level: Medium

Vulnerable Code

python

parser.add_argument('--auth-code', type=str,
                    help='QQ email authorization code')
parser.add_argument('--app-password', type=str,
                    help='Gmail application password')
args = parser.parse_args()

if not os.path.exists(args.file):
    print(f"File does not exist: {args.file}")
    sys.exit(1)

try:
    if args.smtp == 'qq':
        auth = args.auth_code or get_auth_code()
        send_via_qq(args.to, auth, args.file, args.subject)
    else:
        pw = args.app_password or get_gmail_password()
        send_via_gmail(args.to, pw, args.file, args.subject)

The project documentation instructs users to expand credential-bearing environment variables into these command-line options. The original source uses localized help and status strings; the security-relevant control flow is reproduced above in English without changing its behavior.

Technical Analysis

Shell expansion of an environment variable supplied to --auth-code or --app-password places the resulting secret in the process argument vector. Depending on the operating system and process isolation settings, command-line arguments may be visible to other local users, process-monitoring software, job runners, debugging tools, audit collectors, or orchestration telemetry.

If a user supplies a literal secret instead of a variable reference, it may also be retained in shell history. Although the implementation supports safer direct environment-variable retrieval, the exposed CLI options and published examples encourage credentials to be transferred through argv.

Attack Path

1. A user configures an SMTP authorization ...[truncated 1186 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --auth-code and --app-password command-line options.
2. Retrieve credentials directly from environment variables without expanding them into command-line arguments.
3. For interactive use, obtain secrets with getpass.getpass() so they are not echoed or stored in argv.
4. For persistent configuration, use the operating system's credential manager or keyring rather than plaintext files.
5. Update all examples to omit credential-bearing options.
6. Ensure application logs, exception messages, telemetry, and debugging output never contain credentials.
7. Rotate any credential that may already have been passed through exposed command-line arguments.
8. Use provider-specific, minimally scoped application passwords and enable account monitoring and multifactor authentication where supported.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documentation claims support for basic metrics, deep report generation, email delivery, and name-based lookup, but the code reportedly does not implement several of these features. In practice, this can mislead users into providing data, credentials, or trust to a tool that behaves differently, which is a security issue even if not overtly malicious.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documentation claims support for basic metrics, deep report generation, email delivery, and name-based lookup, but the code reportedly does not implement several of these features. In practice, this can mislead users into providing data, credentials, or trust to a tool that behaves differently, which is a security issue even if not overtly malicious.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documentation claims support for basic metrics, deep report generation, email delivery, and name-based lookup, but the code reportedly does not implement several of these features. In practice, this can mislead users into providing data, credentials, or trust to a tool that behaves differently, which is a security issue even if not overtly malicious.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documentation claims support for basic metrics, deep report generation, email delivery, and name-based lookup, but the code reportedly does not implement several of these features. In practice, this can mislead users into providing data, credentials, or trust to a tool that behaves differently, which is a security issue even if not overtly malicious.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documentation claims support for basic metrics, deep report generation, email delivery, and name-based lookup, but the code reportedly does not implement several of these features. In practice, this can mislead users into providing data, credentials, or trust to a tool that behaves differently, which is a security issue even if not overtly malicious.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The QQ mail path misuses the --to argument as both the SMTP login identity and the delivery recipient. This contradicts the documented behavior and can cause reports to be sent to the wrong party, silently redirecting sensitive stock-analysis output back to the mailbox owner instead of the intended recipient. In a tool that generates and emails reports, this creates a real confidentiality/integrity issue rather than a mere functional bug.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The Gmail implementation has the same flaw: it treats the --to value as both sender and recipient, then authenticates and sends mail using that single address. This can misdirect generated reports and encourages unsafe usage patterns where users may provide recipient addresses that are not valid sender accounts, leading to failed delivery or unintended self-delivery of potentially sensitive financial content.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documentation advertises behavior that would require shell execution, file access, and environment-variable handling, but it does not declare any explicit tool scope or permissions boundaries. This creates an authorization ambiguity: an agent may invoke broader capabilities than users expect, increasing the risk of unintended command execution, file access, or credential exposure when the skill is triggered.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger conditions are broad enough to match ordinary requests about stock prices, analysis, report generation, and emailing, but they do not define when higher-risk capabilities should or should not activate. Overbroad activation can cause an agent to invoke shell/file/email behaviors unexpectedly, increasing the chance of unintended external transmission or local file access.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document first states that credentials are only passed via environment variables or runtime configuration, but later indicates jq_login.py performs 'secure storage'. Contradictory guidance around secret handling is dangerous because users cannot reliably determine whether credentials will remain ephemeral or be written to disk, increasing accidental secret persistence and leakage risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation describes emailing generated reports but does not clearly warn that report contents and recipient metadata will be transmitted to third-party email providers. In a financial-analysis context, reports may contain sensitive holdings, analysis, or locally sourced content, so lack of an external-transmission warning increases data leakage risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Describing jq_login.py as both interactive configuration and secure storage without precise details creates uncertainty about whether secrets are merely entered for a session or persisted locally. This ambiguity is especially risky for account passwords and authorization codes because it can lead to insecure local storage practices being mistaken for safe secret management.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script automatically reads JQData credentials from environment variables and performs a network authentication without any explicit user-facing disclosure or consent at runtime. In an agent skill context, this can surprise users or operators by causing unintended credential use and external data transmission, especially when report generation is expected to be a local formatting task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script stores the password in process environment variables while presenting this as a safe non-persistent approach, but environment variables can be exposed to subprocesses, debugging tools, crash reports, shell history patterns, or other local inspection mechanisms depending on platform and runtime. In a stock-analysis skill that may run alongside other tooling, this increases the chance of credential disclosure for the JQData account.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script tells users that credentials are kept only in the current session environment, but it also persists the account identifier to disk in .jq_config.json. That mismatch is a security-relevant deception because users may make trust decisions based on a false storage claim, and the saved phone number can aid account targeting or privacy leakage in a finance-related tool handling brokerage/data-service credentials.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language content that effectively forces a specific language/locale for usage instructions and operational output. Under the policy, locale constraints should either provide user opt-in/choice or be clearly justified as region-specific; neither is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The entire report template and section headings are written only in Chinese, indicating the skill expects a specific language/locale by default. Under the policy criteria, forcing a language without offering user choice or documenting a justified regional constraint is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The entire reference file is written in Chinese, including headings and field labels, with no indication that the skill is intended only for Chinese-speaking users or that alternative languages are available. Under the natural-language policy rule, this can be a locale/language constraint that lacks user opt-in or explicit justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script writes the generated report directly to a user-controlled output path using write mode, which will overwrite an existing file without warning. In normal CLI use this is a safety issue rather than a severe security flaw, but in an agent-driven workflow it can still cause unintended data loss if the path is influenced by user input or automation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

All user-facing instructions and prompts in the script are in Chinese, and there is no indication that language selection is optional or that the tool is intentionally limited to a Chinese-speaking audience. This can violate a language/locale policy when a skill imposes one language without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code writes the configuration file first and only afterward applies chmod 600. On multi-user systems, the file may briefly exist with default permissions determined by the process umask, creating a small race window where another local user could read the stored account identifier before permissions are tightened.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with only a minimum version (akshare>=1.10.0), which makes builds non-reproducible and allows later package releases to be installed without review. This increases supply-chain risk because a compromised or breaking upstream release could be pulled into the skill at install time.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

akshare>=1.10.0
jqdatasdk>=1.8.0
pandas>=1.5.0
requests>=2.28.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Using jqdatasdk>=1.8.0 leaves the exact installed version uncontrolled, so the environment may resolve to different releases over time. That creates a software supply-chain weakness because unreviewed upstream changes or a malicious release could be introduced into this financial-analysis skill.

Content

Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.

text

akshare>=1.10.0
jqdatasdk>=1.8.0
pandas>=1.5.0
requests>=2.28.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

pandas>=1.5.0 is unpinned, so dependency resolution may install any newer version, including releases with unexpected behavior or newly introduced issues. While this file alone does not prove exploitation, it weakens dependency integrity and reproducibility.

Content

Scanner excerpt · scripts/requirements.txt (reported line 3)May include surrounding context.

text

akshare>=1.10.0
jqdatasdk>=1.8.0
pandas>=1.5.0
requests>=2.28.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.