A Stock Vcp

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:56 AM UTC
• Version: 1.0.9

Overview

This skill should be reviewed because it advertises paid, current A-share trading signals, but the included API returns fixed simulated recommendations without enforcing payment.

Install only after treating this as a review item: verify that any deployed endpoint actually enforces x402 payment, confirm whether the stock signals are live or simulated, and do not rely on the returned recommendations as current financial advice without independent validation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: api.py:10

Finding

Paid signal endpoints expose static simulated data without payment verification

Content

View full analysis

Vulnerability Details

File Location: api.py:10-24, 32-41, 43-52; SKILL.md:25-29, 59
Vulnerability Type: Missing payment authorization and misleading data provenance
Risk Level: High

Vulnerable Code

python

# VCP signal data (simulated)
VCP_SIGNALS = [
    {"code": "688041", "name": "纳芯微", "price": 125.80, "change": 4.5, "sector": "半导体",
     "rvol": 2.3, "atr_ratio": 0.42, "stars": "⭐⭐⭐", "stop_loss": 119.51, "target": 138.38,
     "reason": "VCP突破+量能放大+半导体板块热度高"},
    {"code": "688126", "name": "沪硅产业", "price": 28.90, "change": 3.2, "sector": "半导体",
     "rvol": 1.8, "atr_ratio": 0.48, "stars": "⭐⭐", "stop_loss": 27.46, "target": 31.79,
     "reason": "缩量回调后放量突破"},
    {"code": "688008", "name": "澜起科技", "price": 78.50, "change": 5.8, "sector": "半导体",
     "rvol": 2.1, "atr_ratio": 0.45, "stars": "⭐⭐⭐", "stop_loss": 74.58, "target": 86.35,
     "reason": "VCP形态紧凑+突破前高"},
]

python

def get_vcp_signals() -> dict:
    """Return VCP signals."""
    return {
        "success": True,
        "timestamp": datetime.now().isoformat(),
        "pattern": "VCP",
        "count": len(VCP_SIGNALS),
        "signals": VCP_SIGNALS,
        "payment": PAYMENT_INFO
    }

def create_app():
    """FastAPI application."""
    from fastapi import FastAPI

    app = FastAPI(title="A股 VCP信号 API", version="1.0.0")

    @app.get("/signals")
    @app.get("/vcp")
    async def signals():
        return get_vcp_signals()

Technical Analysis

The Skill documentation describes an x402 workflow in which an API request triggers a payment challenge, payment is completed, and protected VCP screening results are returned. The implementation does not contain authentication middleware, payment-proof validation, transaction confirmation, replay protection, or access-control checks.

Both /signals and /vcp call get_vcp_signals() directly and return the complete dataset to ...[truncated 1525 chars]

Remediation

View remediation

Remediation Suggestions

1. Place payment verification middleware in front of /signals and /vcp.
2. Return an x402 payment challenge when a valid proof is absent.
3. Verify the payment recipient, chain ID, token contract, amount, transaction status, and request association before disclosing results.
4. Implement replay protection by recording consumed transaction identifiers or signed payment nonces.
5. Fail closed when payment verification services are unavailable or return ambiguous results.
6. Retrieve data from the documented sources and perform the advertised VCP analysis before generating recommendations.
7. Include the market-data observation time and source in each response rather than assigning a fresh timestamp to static records.
8. If the endpoint is only a demonstration, prominently label every response as simulated, remove live-data claims, and disable real payment requests.
9. Add automated tests confirming that unpaid, invalid, underpaid, wrong-chain, and replayed payment proofs cannot access protected results.

T08 · Insecure Dependencies

Note

• Location: skill.json:10

Finding

Runtime dependencies are declared without version or integrity constraints

Content

View full analysis

Vulnerability Details

File Location: skill.json:10
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Low

Vulnerable Code

json

"dependencies": ["fastapi", "uvicorn"],

Technical Analysis

The project declares fastapi and uvicorn without exact versions, a lockfile, or integrity hashes. Consequently, separate installations can resolve to different package versions from the configured package index.

This does not establish that either named package is malicious. It creates a supply-chain and reproducibility weakness because the installed code may differ from the code reviewed during this audit. A compromised upstream release, an unsafe package index configuration, or an incompatible future release could therefore affect the application without any change to the Skill repository.

Attack Path

1. A deployment or user installs the dependencies declared in skill.json.
2. The package resolver selects the latest versions available from the configured index.
3. Those versions may differ from the versions used during development or security review.
4. If a selected release or package source is compromised, its installation or import-time behavior runs within the deployment environment.
5. Starting the API imports both dependencies, exposing the application to the behavior of the unreviewed resolved versions.

This path depends on an unsafe or compromised dependency release or source; no such compromise was identified in the audited files.

Impact Assessment

Impact depends on the behavior of the resolved dependency. A malicious package release could potentially execute code with the privileges of the account installing or running the API. An incompatible but non-malicious release could instead cause application failure or unexpected security behavior.

The audited project itself does not request elevated privileges, so the maximum local scope would ordinarily be limited ...[truncated 123 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each dependency to an exact, reviewed version.
2. Generate and commit a lockfile appropriate to the deployment toolchain.
3. Use cryptographic hashes for downloaded distributions where supported.
4. Install packages only from an explicitly configured trusted package index.
5. Run dependency vulnerability and license scanning in continuous integration.
6. Review and deliberately update pinned versions rather than resolving mutable latest versions during deployment.
7. Build deployments in an isolated environment and run the API under a dedicated, least-privileged service account.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The natural-language content of the skill, including its description and operating instructions, is presented entirely in Chinese. This can amount to a language/locale policy violation because the skill forces a specific language without user opt-in or an explicit justification that it is limited to Chinese-speaking users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file’s user-facing natural-language strings and API description are entirely in Chinese, indicating a fixed language choice for the skill. Under the policy, forcing a specific language without offering the user a locale choice or documenting a justified region-specific constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.