Security audit

趋势启动扫描器

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent stock-scanning tool, but it needs Review because some included utilities can overwrite importable Python files with unvalidated market data and load code from outside the skill package.

Review carefully before installing. Run it only in an isolated environment, avoid the stock-pool fetch/rebuild scripts until they stop generating executable Python from remote data, and check the hard-coded .qclaw paths so it does not overwrite files you care about. Treat all financial output as research only, not investment advice.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: fetch_stock_list.py:26
Finding: Remote market data is written into executable Python modules without safe serialization
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: trend_scanner.py:31
Finding: The main scanner imports executable code from an unaudited external workspace directory
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: skill.json:12
Finding: Third-party dependencies are incomplete and not reproducibly pinned
Content: View full analysis
=3.8", "pandas": ">=1.0.0", "numpy": ">=1.0.0", "requests": ">=2.0.0" }, "config": { "min_score": 60, "scan_stocks": 200 } ``` `fetch_stocks_akshare.py:6` uses an optional package not declared in the metadata: ```python import akshare as ak ``` Several scripts also use BaoStock without declaring it in `skill.json`, including `rebuild_stock_pool.py:7`: ```python import baostock as bs ``` ### Technical Analysis Lower-bound-only dependency constraints permit installation of any later release, including releases that have not been reviewed with this project. The package set is therefore not reproducible. AkShare and BaoStock are imported by included scripts but are absent from the dependency declaration. Users must infer and install them separately, increasing the likelihood of installing an unintended version or package from an untrusted source. Python package installation may execute package build or installation logic. Although no malicious dependency was identified in the audited files, incomplete declarations and unrestricted version resolution increase supply-chain exposure. ### Attack Path 1. A user prepares the environment or runs a script requiring AkShare or BaoStock. 2. The user installs an undeclared package manually, or a package resolver selects the newest release allowed by a broad lower-bound constraint. 3. A compromised, incompatible, or otherwise unreviewed package release is installed. 4. Package installation code or imported package code executes in the user's environment. 5. The dependenc ...[truncated 630 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (45)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file presents all user-facing instructions and descriptions in Chinese, including the title, feature descriptions, usage guidance, and disclaimer. Under the policy criteria, forcing a specific language without user opt-in or documented justification can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module docstring and all user-facing console messages are written only in Chinese, indicating the skill is designed to operate in a fixed language without any visible opt-in or fallback. Under the policy, locale or language constraints should either be user-selectable or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring says the strategy is for stocks scoring 70+ and the code logic enforces sig['total'] >= 70, but later output labels describe the strategy as '80分以上' and the file is named backtest_80plus_v2.py. This is an active contradiction in the skill's own documentation/output about what strategy is actually being evaluated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This Python file presents its purpose and user-facing status/output text entirely in Chinese, starting with the module docstring and continuing throughout the script. Under the policy rule for natural-language violations, this is a locale/language constraint without any opt-in, fallback, or documented region-specific justification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script prepends a hard-coded external directory to sys.path and then imports executable Python modules from that location. In a skill context, this expands the trust boundary beyond the file itself: if that directory or the imported files are modified, the script will execute attacker-controlled code during import, which can lead to arbitrary code execution under the current user account.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file's descriptive text, CLI description, and user-facing output are written entirely in Chinese, and stdout is explicitly configured for UTF-8 Chinese output. There is no indication that the user can choose another language or that the locale restriction is documented as an intentional region-specific limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This Python file contains user-facing natural-language text entirely in Chinese, including the module description and later console messages, with no indication that language is configurable or limited to a justified region-specific use case. Under the policy rule for language/locale constraints, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains user-facing documentation and console output in Chinese, including the module docstring and later printed messages, but does not indicate that the skill is region-specific or provide any user opt-in for language selection. That creates a locale policy concern because the skill effectively forces a specific language on users.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The top-level docstring states that the file 'fetches the full A-share stock list' from the Eastmoney API. In practice, the script does substantially more: it excludes STAR Market, Beijing Exchange, ST, delisted, and several industry/name-based categories in filter_stocks, then persists the reduced set to a local file in save_pool. This is an active contradiction in stated intent versus actual behavior, not just an omitted implementation detail.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script writes generated code to a hard-coded path inside a skills/workspace directory without user confirmation, path validation, or safe output controls. In an agent-skill context, silent file writes can overwrite trusted local files, introduce persistence, or modify downstream behavior if that generated file is later imported or executed by other tooling.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module docstring at L003 and function docstring at L010 both state that the skill gets A-share stock lists from Tencent's API. However, the actual requests in the implementation go to Eastmoney endpoints at L026, L039, and L053, while the Tencent URL at L012 is never used. This is an active contradiction between documentation and code behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script writes a generated Python file to a hard-coded path inside a local workspace without user confirmation. In an agent/skill context, silent file creation or overwrite can modify code artifacts unexpectedly, potentially clobbering existing files or planting code that will later be imported and executed by other tooling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script writes a generated Python file to a hard-coded path under a specific user's workspace without prompting, validation, or ensuring the destination is intended. In an agent/skill context, silent filesystem modification is risky because it can overwrite project files, alter later-executed code, or fail unpredictably on other systems while the user may not realize a write occurred.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring says it retrieves a '完整A股列表' and the fetch function says it gets an 'A股列表', yet the script is configured to fetch hs_a, sh_b, and sz_b data and later removes B股, ST, delisted, sector-specific, and other stocks before saving. This is not just incomplete documentation; it materially contradicts the apparent intent conveyed by the docstrings of producing a complete A-share list.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script writes a generated Python file to a hard-coded path under a user profile without confirmation, which can overwrite existing local content or unexpectedly modify a skill workspace. In an agent or automation context, silent filesystem writes are risky because they create side effects outside the caller’s immediate awareness and could corrupt trusted code or data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script writes directly to a fixed Python file path under a skill/workspace directory, replacing its contents without validation, backup, or confirmation. In an agent-skill context, this is dangerous because running the script mutates executable code on disk and could unintentionally corrupt a skill, overwrite trusted logic, or enable persistence if upstream data or local edits influence the generated output.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script unconditionally writes a generated Python module to a hard-coded path under the user's workspace, which can overwrite an existing skill file without confirmation or validation. In an agent-skill context, modifying executable code in a fixed location is more dangerous than a normal data export because it can silently alter future agent behavior or destroy existing logic.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This Python file contains natural-language descriptions and user-facing output entirely in Chinese, beginning with the module docstring and continuing throughout the reporting strings. The file does not offer any language selection or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context, which matches the policy's language/locale violation criterion.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This Python file contains user-facing natural-language descriptions and output strings entirely in Chinese, including the module docstring and later console messages. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module docstring says the prefilter automatically excludes ST, delisted stocks, STAR Market, liquor, banks, real estate, and names containing '地产'. However, the implementation also excludes stocks in the '证券' industry and any stock name containing '证券' at L666-L673. This is an active contradiction between stated intent and actual filtering behavior, not merely omitted implementation detail, because it changes which stocks are removed.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module documentation says this script performs a historical backtest using historical K-line data to infer past TOP5 stocks and compute one-week returns. However, the executable defaults later use future dates (L216 and L394), which can yield no valid historical interval or otherwise fail to perform the documented historical backtest behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module docstring and all user-facing console output are fixed in Chinese, which imposes a specific language on users without opt-in. The policy requires either offering a language/locale choice or clearly documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This code saves scan output to a CSV file and later writes a push-message text file containing recommendation/tracking information. Although the file paths are printed after writing, there is no prior disclosure or confirmation before persisting potentially sensitive financial analysis data to local storage.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file's docstring and all user-facing console and push-message text are written in Chinese, and there is no option for users to select another language or indication that the skill is intentionally region- or locale-specific. This can violate a language/locale policy when skills must not force a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module description, user-facing report strings, and test output are all written in Chinese, indicating the skill is designed to operate in a single language by default. There is no visible opt-in, locale selection, or documentation justifying the language constraint as region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.