Security audit

Akshare Stock 1.0.1

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward A-share market data helper with normal dependency and reliability caveats, not hidden or destructive behavior.

Install and run this in a dedicated virtual environment, preferably with pinned AkShare and Baostock versions. Treat outputs as market data for research only, not investment advice, and expect that some advertised or scripted actions may need fixes or direct AkShare calls before they work reliably.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:10
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
``` 2. Store dependencies in a lock file or requirements file containing cryptographic hashes. 3. Install with hash enforcement, for example: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Pin and review relevant transitive dependencies through a reproducible dependency-management process. 5. Explicitly document the trusted package index and, where appropriate, disable untrusted supplemental indexes. 6. Run installation and execution in a dedicated virtual environment or sandbox under a non-privileged account. 7. Add automated dependency scanning and review dependency updates before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/stock_cli.py:55
Finding: User-Controlled Regular Expression in Stock Search
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The description mostly matches the general domain and data-access purpose: this is indeed an A-share data tool built around AkShare, and it supports quote lookup, historical行情, sector/concept board retrieval, and stock search. However, the declared description is broader than the actual code. The supplied code does not retrieve explicit财务数据, nor does it perform财务分析 or选股/screening; it is primarily a simple command-line data fetcher. Additionally, the fund flow action appears buggy because it calls stock_individual_fund_flow directly instead of ak.stock_individual_fund_flow, so that capability may fail at runtime. This is a partial description-behavior mismatch due to overclaiming important capabilities.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: get_fund_flow 的注释和函数名表明它会获取股票资金流向数据，但实现中在 L054 调用的是未定义的 stock_individual_fund_flow(...)，而不是前文一致使用的 ak.<func> 形式。这不是单纯信息缺失，而是文档所宣称的能力与实际行为相矛盾：函数并不能按说明完成资金流向查询。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code presents its description, help text, and error messages exclusively in Chinese, including the CLI description and runtime output. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.