Baostock 1.0.3

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:38 AM UTC
• Version: 1.0.0

Overview

This is a coherent BaoStock data-query skill with expected examples and dependencies, with the main caution being unpinned Python package installation.

Install it in a virtual environment or container, pin reviewed versions of baostock and pandas if reproducibility matters, and treat the included financial analysis/backtesting examples as educational data workflows rather than trading advice.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies Permit Unreviewed Package Installation

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2; installation instructions also appear in SKILL.md:13-16, README.md:16-19, and demo_project/README.md:7-10
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Complete vulnerable code snippet:

text

baostock>=0.8.0
pandas>=1.5.0

The project also recommends installing the latest available BaoStock release:

bash

pip install baostock --upgrade

The demo installation instructions consume the mutable requirements directly:

bash

pip install -r ../requirements.txt

Technical Analysis

Both dependencies use open-ended >= constraints, and the documentation additionally recommends --upgrade. Consequently, installation results depend on whichever package versions are available from the configured Python package index at installation time. The project does not include a lockfile, package hashes, or another integrity mechanism that restricts installation to artifacts reviewed during this audit.

Python package installation may execute package build or installation logic. If an upstream package account, release artifact, package index, or dependency chain is compromised, a later malicious release satisfying these constraints could be selected automatically. This is a supply-chain weakness rather than evidence that the currently named packages are malicious.

Attack Path

1. An attacker compromises an upstream package publisher, release process, package index, or transitive dependency.
2. The attacker publishes a malicious release whose version satisfies baostock>=0.8.0 or pandas>=1.5.0.
3. A user or AI Agent follows the documented command using --upgrade or installs requirements.txt.
4. pip resolves and downloads the attacker-controlled package artifact.
5. Malicious build, installation, import-time, or runtime code executes in the installation envir ...[truncated 732 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace open-ended constraints with exact versions that have been reviewed and tested, for example:

   text

   baostock==REVIEWED_VERSION
   pandas==REVIEWED_VERSION
   

2. Generate and commit a reproducible lockfile containing cryptographic hashes for all direct and transitive dependencies.
3. Install with hash enforcement, such as:

   bash

   pip install --require-hashes -r requirements.lock
   

4. Remove --upgrade from installation documentation so users do not automatically consume unreviewed future releases.
5. Configure installations to use a trusted or internally mirrored package index.
6. Run dependency installation and the demo in a non-privileged virtual environment or isolated container.
7. Add automated dependency vulnerability and provenance checks to CI, and review version updates before modifying the lockfile.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file contains user-facing instructions and descriptions in Chinese, but does not indicate that the skill is China-specific only or offer an opt-in language/locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The entire quick reference is written in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to Chinese-speaking users. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file presents all user-facing instructions in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. This can violate a language/locale policy when a skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The dependency is specified with only a minimum version and no upper bound or exact pin, which makes builds non-reproducible and can pull in unexpected upstream changes. While this is a supply-chain hygiene issue rather than an immediately exploitable flaw by itself, it increases exposure to malicious or vulnerable future releases.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

baostock>=0.8.0
pandas>=1.5.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using pandas>=1.5.0 without an exact pin allows installation of any later release, reducing reproducibility and increasing supply-chain risk if a bad or incompatible version is published. In a data-processing skill, pandas is a high-impact library because it is widely used and often deeply integrated into runtime behavior.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

baostock>=0.8.0
pandas>=1.5.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.