Ashare Fast Watcher

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:35 AM UTC
• Version: 1.0.1

Overview

This skill is a financial market tool with unclear scope and unsafe local notification code, so users should review it carefully before installing.

Install only if you are comfortable with a China-market trading-signal tool rather than a simple market watcher. Do not run the daemon with elevated privileges, avoid relying on its alerts for real trades without independent verification, and prefer a version that removes shell execution, uses authenticated market-data transport, documents all modes and data sources, and restores user-controlled trading-hours behavior.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: daemon.py:22

Finding

Arbitrary Command Injection Through Market-Controlled Notification Content

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.py:5

Finding

Market Data and Trading Signals Can Be Manipulated Through Plaintext HTTP

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill claims Tencent direct API and millisecond-level continuous monitoring, but the analyzed behavior reportedly uses different data interfaces, scans unrelated instruments, and performs one-off ranking output. Such misrepresentation is a security and trust issue because reviewers cannot accurately assess data flows, dependencies, or operational behavior from the manifest.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill claims Tencent direct API and millisecond-level continuous monitoring, but the analyzed behavior reportedly uses different data interfaces, scans unrelated instruments, and performs one-off ranking output. Such misrepresentation is a security and trust issue because reviewers cannot accurately assess data flows, dependencies, or operational behavior from the manifest.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims Tencent direct API and millisecond-level continuous monitoring, but the analyzed behavior reportedly uses different data interfaces, scans unrelated instruments, and performs one-off ranking output. Such misrepresentation is a security and trust issue because reviewers cannot accurately assess data flows, dependencies, or operational behavior from the manifest.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The implementation materially diverges from the declared skill purpose: instead of a millisecond-level A-share watcher using Tencent direct API, it performs ad hoc screening of convertible bonds and cross-border ETFs using AkShare/Eastmoney-style data sources. This kind of spec/behavior mismatch is dangerous because users and orchestrators may grant the skill trust, permissions, or workflow placement based on the manifest, while the code actually performs different market analysis and may produce misleading outputs in a trading context.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill metadata declares no explicit tool scope, yet the analyzed implementation reportedly uses both network and shell capabilities. That creates an authorization and transparency gap: operators may approve a seemingly simple market-data skill without realizing it can execute shell commands or make arbitrary outbound requests.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill constructs a shell command and invokes it with os.system to display notifications. Although the current message content is internally generated from market data and only escapes double quotes, shell execution is still an unnecessarily powerful primitive for this use case and can become dangerous if any upstream data contains unexpected characters or if future changes introduce less-controlled input.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring, notification text, and console output are written in Chinese, and the rest of the file continues this pattern for all user-facing messages. This imposes a specific language on users without any opt-in, selection mechanism, or justification that the skill is intended only for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Lines L43-L44 describe automatic silence outside trading hours to save resources, and L52 says the restriction is being forcibly opened for testing. But L53 uses 'if True', meaning the monitor ignores the computed trading-time gate entirely and always runs, directly contradicting the stated behavior in the comments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

User-supplied security identifiers are sent to a third-party endpoint over plain HTTP without any disclosure, allowing those inputs to be exposed to the remote service and potentially intercepted in transit. In this skill context, ticker queries may reveal user trading interests or strategy targets, making the privacy leak more meaningful than a generic quote lookup.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · index.py (reported line 8)May include surrounding context.

python

def fetch_raw_data(code_str):
    url = f"http://qt.gtimg.cn/q={code_str}"
    try:
        resp = requests.get(url, timeout=0.5)
        if resp.status_code == 200:
            return resp.text.strip().split(';')
        return []

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says this skill is a millisecond-level market data watcher using Tencent's API, which implies monitoring and retrieval of market quotes. However, the code goes further by implementing decision logic that emits actionable trading-style outputs such as "TRIGGER_BOND_BUY" and "QUEUE_ETF_LIMIT_UP", effectively acting as a signal generator rather than a passive watcher.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The docstring at L43 describes the function as "ETF 溢价率监控逻辑" (ETF premium monitoring logic), which suggests observation and reporting. In practice, when thresholds are met the function returns an imperative action "QUEUE_ETF_LIMIT_UP" and a message urging use of a trading channel, which is more than monitoring and contradicts the stated intent of passive watch logic.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script's user-facing strings are entirely in Chinese, including status messages, headings, and error output. This imposes a specific language on users without any opt-in, fallback, or documentation that the skill is intended only for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The user-facing banner and in-code comments present the tool as a proprietary 'hot money radar' for speculative pre-market selection, which conflicts with the stated role of a neutral A-share market data watcher. This inconsistency increases the risk of operator deception and misuse, especially in financial settings where users may rely on branding and descriptions to judge suitability, data provenance, and compliance boundaries.

Content

No source excerpt is available for this finding.