Quant Strategy Bundle

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 11:06 PM UTC
• Version: 1.0.0

Overview

This skill is a lightweight quantitative-trading reference with expected dependency and token configuration notes, but no bundled executable code or hidden behavior.

Install dependencies in a virtual environment, consider pinning reviewed package versions, and keep the Tushare token out of shared files or repositories. Treat the strategy examples as educational unless you add and review actual implementation code.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:37

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37–40
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code Snippet:

markdown

### Install Dependencies
```bash
pip install pandas numpy xgboost tushare

text

### Technical Analysis

The installation command retrieves third-party packages without exact version constraints, cryptographic hashes, or a dependency lockfile. This allows the resolved package versions to change between installations and prevents users from verifying that downloaded artifacts match versions reviewed by the project maintainer.

Python package installation may execute package-controlled build or installation logic. If an upstream release or package-distribution account is compromised, a user following this command could install and execute attacker-controlled code. The listed names do not exhibit obvious typosquatting, and no untrusted custom package index is specified; therefore, the finding concerns insufficient dependency integrity controls rather than evidence that any named package is currently malicious.

### Attack Path

1. An attacker compromises an upstream dependency, its maintainer account, or its distribution process.
2. The attacker publishes a malicious release under one of the dependency names.
3. A user runs `pip install pandas numpy xgboost tushare` as documented.
4. Because no approved versions or hashes are enforced, `pip` may resolve and download the malicious release.
5. Package-controlled installation, build, import, or runtime code executes with the permissions of the user running the command.

### Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the invoking user. Within that privilege boundary, malicious dependency code could read or modify accessible files, tamper with strategy calculations and backtest results, access environment v
...[truncated 474 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an exact, reviewed version in a requirements or lock file.

2. Generate and verify cryptographic hashes for all resolved packages, including transitive dependencies.

3. Install with hash enforcement, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Use a dependency-management tool that produces a reproducible lockfile and review lockfile changes before release.

5. Explicitly use a trusted package index and avoid unreviewed additional indexes or dependency sources.

6. Recommend installation inside a dedicated virtual environment or other isolated environment under a non-privileged account.

7. Add automated dependency vulnerability and provenance checks to the release process.

8. Periodically update pinned versions through reviewed changes rather than resolving unrestricted latest versions during end-user installation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.