T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:203- Finding
SMTP Authorization Credential Stored in Plaintext Source Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
量化选股系统 - 基于 AKShare + 多因子模型的 A 股选股工具
Security checks for vulnerabilities and agentic risk
Overview
This stock-picking skill is not overtly malicious, but it asks for email credentials and automated stock-recommendation workflows while the packaged code is incomplete and contains scoring issues that could mislead users.
Review carefully before installing. Treat generated stock picks as unaudited financial signals, not advice; avoid using automatic schedules until the missing scripts and scoring logic are verified; store email credentials in environment variables or a secret manager instead of source files; and install pinned dependency versions in an isolated environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Unbounded Third-Party Dependency Versions Permit Unreviewed Future Releases
- Content
View full analysis
=1.18.0 pandas>=1.5.0 numpy>=1.23.0 ``` The documented installation command resolves these open-ended requirements from the configured Python package index: ```bash pip3 install -r requirements.txt ``` ### Technical Analysis Every direct dependency is specified using only a minimum version. There is no upper bound, exact version pin, lock file, or package hash. Consequently, an installation performed after the audit may resolve to versions that were not reviewed or tested with this package. Dependency resolution may also select different transitive dependencies over time. The dependency names are conventional PyPI package names, and the audit found no evidence of typographical package names, dependency confusion, or an explicitly malicious package source. The risk arises from allowing future, unreviewed releases to enter the execution environment automatically. Python dependencies can execute code during installation or when imported by the included factor modules. A compromised upstream release, malicious transitive dependency, or incompatible future release could therefore affect confidentiality, integrity, availability, or calculation correctness. ### Attack Path 1. A user runs `pip3 install -r requirements.txt` as instructed. 2. The package installer queries its configured package index and selects the newest versions satisfying the minimum constraints. 3. A future direct or transitive release that was not included in this audit is resolved. 4. If that release is compromised, malicious code executes during package installation or subsequent import. 5. The dependency code operates with the privileges of the user or service running the installation and stock-analysis process. This path depends on a compromised or unsafe future d ...[truncated 789 chars]- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (15)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases include very generic financial terms such as '选股', '推荐股票', and '今日推荐', which can match ordinary user conversation and cause the skill to activate unexpectedly. In this context, accidental invocation is more sensitive because the skill can drive stock-picking workflows, generate recommendations, and potentially send emails, creating a meaningful risk of unintended financial guidance or automated actions.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The capital-factor function returns hard-coded positive placeholder values instead of real fund-flow data, which guarantees an artificial contribution to the final score. In a stock-selection system, this is dangerous because it can systematically bias recommendations and mislead users into trusting fabricated '资金面' analysis.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The combined-score logic claims to use a 90% concentration factor via chip_factors.get('details', {}), but calculate_chip_factors() flattens and returns only selected fields and does not preserve a nested details object. As a result, the concentration component is effectively always absent or defaults incorrectly, causing the ranking model to silently mis-score stocks while presenting results as quantitatively grounded.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language text that forces a specific language/locale for the skill description and console interaction. Under the policy, locale-specific language is only acceptable when the skill offers user choice or clearly documents a justified regional constraint, which is not present here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The entire skill description and usage guidance are presented in Chinese, including risk warnings and setup instructions, with no indication that other languages are supported or that the Chinese-only presentation is an intentional, justified regional constraint. This can violate the language/locale policy because users are not given an explicit language choice or opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The natural-language skill description forces a specific language presentation, but the file does not mention that the skill is Chinese-only, region-specific, or that users can choose another language. Under the language/locale policy, a fixed language without user opt-in or documented justification is a policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This Python file contains natural-language strings in Chinese in the module docstring and throughout the script, which effectively forces a specific language for users and maintainers. The policy allows locale constraints only when they are optional or clearly justified, neither of which is present here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code file contains natural-language descriptions exclusively in Chinese, and the same locale choice continues in user-facing console output. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The main routine prints status and test messages only in Chinese, which enforces a specific language for user-visible behavior. The file does not indicate that the skill is region-specific or provide any mechanism for the user to choose a language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The print statements in the executable test block present operational results only in Chinese. This is a natural-language policy concern because the file does not offer opt-in language selection or indicate that Chinese-only output is required for a justified regional use case.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency on akshare is only lower-bounded and not pinned to a specific version, which makes builds non-reproducible and increases supply-chain risk if a later compromised or incompatible release is installed. In a stock-selection skill that likely runs on a schedule and may fetch external market data automatically, silently pulling newer package versions can change behavior or introduce malicious code paths without review.
- Content
text akshare>=1.18.0 pandas>=1.5.0 numpy>=1.23.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The pandas requirement is unpinned, so the environment may install different versions over time, including versions with known or future vulnerabilities. Because this skill appears to perform automated quantitative analysis, inconsistent dependency resolution can affect both integrity of results and exposure to vulnerable transitive code during scheduled execution.
- Content
text akshare>=1.18.0 pandas>=1.5.0 numpy>=1.23.0
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The numpy dependency is specified with a minimum version only, which allows uncontrolled upgrades and prevents reproducible deployments. For an automated analytics skill, this expands supply-chain risk and can unexpectedly introduce vulnerable or breaking versions into production.
- Content
text akshare>=1.18.0 pandas>=1.5.0 numpy>=1.23.0
Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Static analysis
No suspicious patterns detected.