T06 · System Persistence
Error
- Location
SKILL.md:1066- Finding
Default recurring report delivery creates cross-session persistence without prior opt-in
- Content
View full analysis
- Remediation
View remediation
Security audit
A股市场分析报告/china A stocks daily review
Security checks for vulnerabilities and agentic risk
Overview
The skill is a market-reporting tool, but it defaults to recurring external report pushes, handles a Tushare token unsafely, and can generate current-looking financial reports from hard-coded claims.
Review this before installing. Use it only if you explicitly want recurring financial reports and can disable or approve each push destination. Do not store a valuable Tushare token for this version unless the endpoint is changed to HTTPS and the credential flow is clearly documented. Treat generated reports as unverified because parts of the renderer are hard-coded and may look current even when data is missing.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:95- Finding
Stored Tushare API token is transmitted over unencrypted HTTP
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:172- Finding
Setup instructions inject an undisclosed referral registration link
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
render_report.py:89- Finding
Dynamically dated financial reports contain hard-coded and potentially stale market claims
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:211- Finding
Runtime dependencies are installed without exact version or integrity pinning
- Content
View full analysis
= 3.10 akshare >= 1.10.0 (pip install akshare) tushare >= 1.2.89 (optional; pip install tushare) baostock (optional; pip install baostock) ``` `SKILL.md` also gives the following installation instruction at line 365: ```text pip install akshare ``` ### Technical Analysis The project imports `akshare` directly in `fetch_review_v2.py`, but it provides no lockfile, exact version, package hashes, or isolated-environment requirement. A lower-bound constraint such as `akshare >= 1.10.0` allows any future release to be selected. Python packages execute code during installation and import. Consequently, the effective code executed by the Skill can change after the Skill itself has been reviewed. This is a supply-chain weakness even though the audit found no evidence that the named packages are currently malicious. The optional packages are similarly unpinned, and `baostock` has no version constraint at all. ### Attack Path 1. A user follows the documented `pip install` command. 2. The package resolver selects the latest version available from the configured package index. 3. A compromised account, malicious release, index compromise, or unsafe mirror supplies altered package code. 4. Package installation or later import executes that code in the user's Python environment. 5. The dependency receives the same filesystem and network permissions as the report scripts. ### Impact Assessment If the dependency supply chain is compromised, arbitrary Python code could execute with the privileges of the user running the Skill. That scope could include: - Reading files available to the current user. - Accessing the network. - Modifying report files or generated data. - Reading locally stored tokens, including `~/.tushare_token`. - Persisting thr ...[truncated 153 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (22)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
This mismatch is more serious because the finding indicates hardcoded narratives and fabricated-looking fallback content despite claims that missing data is left blank. In a finance-reporting skill, undeclared synthesis of pseudo-factual market content can mislead users, propagate false information, and mask the absence of real data sources.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
This mismatch is more serious because the finding indicates hardcoded narratives and fabricated-looking fallback content despite claims that missing data is left blank. In a finance-reporting skill, undeclared synthesis of pseudo-factual market content can mislead users, propagate false information, and mask the absence of real data sources.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Automatic scheduling, file creation, and message pushing are enabled by default without prominent upfront consent for ongoing side effects. This can lead to silent persistence and repeated outbound data transmission, which is especially risky in a skill that reads previous files and writes reports autonomously.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documentation claims the token is not uploaded to any cloud, but the code necessarily transmits it over the network to the Tushare API for authentication. This is a misleading security assurance around credential handling, and users may provide secrets under false assumptions about where they travel.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The renderer hardcodes market narratives, fallback figures, and interpretive statements even when data may be missing, contradicting the skill contract that missing fields should be left blank and not fabricated. In a finance context, this can mislead users into acting on invented or stale content presented as current analysis, creating integrity and trust risks.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This section provides action-oriented trading guidance such as sectors to watch, low-level follow-up opportunities, and conditions for participation, which exceeds the stated scope and moves into recommendation behavior. In a market-review skill, such advice can drive user financial decisions without suitability controls, disclosures, or authorization, making the context more dangerous.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README frames the skill as optimized for WeChat mobile reading and the report format examples are centered on Chinese-market conventions and Chinese-language presentation. There is no explicit opt-in or user-selectable language/locale behavior, which can violate language/locale policy when a skill effectively forces a specific presentation style by default.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README states that daily auto-push is enabled immediately after installation and that reports are sent to linked messaging channels such as WeChat or WhatsApp. That creates default data transmission to third-party destinations without explicit opt-in, consent, or a clear privacy warning about what content will be sent and where it will be stored, which is a legitimate privacy and safety issue.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documents and embeds capabilities for local file reads/writes, network access, and shell/Python execution but does not declare an explicit tool scope or permission boundary. In an agent environment, this increases the chance of over-broad execution, accidental misuse, or abuse through prompt-triggered invocation because the runtime has more power than the manifest advertises.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad and overlap with normal conversation about markets, creating a meaningful risk of accidental invocation. Because this skill can perform network access, file creation, automation, and outbound delivery, unintended triggering is more dangerous than it would be for a read-only helper.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is presented as a reporting tool, but it also performs default auto-push to external messaging endpoints. That is a broader action surface than passive report generation and can exfiltrate generated or propagated content to third-party channels without a fresh per-use confirmation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Default scheduled automation plus message delivery extends the skill from on-demand analysis into persistent autonomous operation. In an agent setting, this increases blast radius by creating recurring file writes, repeated network access, and repeated outbound delivery without requiring contemporaneous user intent.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The automation reads previously generated report files and reuses their contents in later outputs that may be pushed to external messaging endpoints. This creates a natural-language propagation channel where tainted, incorrect, or unexpectedly sensitive content can persist across runs and be redistributed automatically.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file defines user-facing control phrases and first-run setup text only in Chinese, and multiple report templates are written as fixed Chinese output formats. This creates a language policy issue because the skill effectively assumes a specific language rather than offering the user a language or locale choice.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest and earlier sections describe a strict fallback chain of Tushare Pro, then AKShare, then search-engine retrieval, with missing data left blank. Later sections introduce direct Sina Finance scraping, BaoStock fallback, JSON intermediate files, template/render scripts, and hardcoded fallback behavior, which materially expands operational behavior beyond the advertised 3-tier architecture.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring states this is a "盘后复盘数据获取脚本" and the implementation only fetches end-of-day style market data such as closing indexes,涨停池,北向资金,市场情绪, and sector flows. There is no code for pre-market briefing, intraday snapshot generation, or the declared third-tier search-engine fallback; this materially under-implements the broader manifest description.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and all user-facing messages are explicitly in Chinese, indicating a fixed language/locale behavior. There is no indication that the user can opt into another language or that the Chinese-only constraint is documented as a justified region-specific requirement.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The section header and log messages say "降级搜索" when sector flow fetching fails, implying a real fallback to search. In practice, the code just catches the exception, sets
sector_ok = False, and proceeds without any search request, so the inline documentation actively misstates behavior.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code file contains natural-language strings exclusively in Chinese, including the top-level description and runtime messages, with no indication that the skill is China-region-specific or that users can opt into the language. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 先删除旧文件（如果有） if JSON_OUT.exists(): JSON_OUT.unlink() result = subprocess.run( [sys.executable, str(FETCH_SCRIPT)], capture_output=True, text=True,
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script writes fetch_data.json to disk via JSON_OUT.write_text(), which is a file-modifying operation. Although the script prints after the write succeeds, there is no prior warning, confirmation prompt, or comment/docstring near the write indicating this side effect to the user.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The entire report template is written in Chinese and does not mention any option to select another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified.
- Content