A股市场分析报告/china A stocks daily review

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:52 AM UTC
• Version: 1.0.3

Overview

The skill is a market-reporting tool, but it defaults to recurring external report pushes, handles a Tushare token unsafely, and can generate current-looking financial reports from hard-coded claims.

Review this before installing. Use it only if you explicitly want recurring financial reports and can disable or approve each push destination. Do not store a valuable Tushare token for this version unless the endpoint is changed to HTTPS and the credential flow is clearly documented. Treat generated reports as unverified because parts of the renderer are hard-coded and may look current even when data is missing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T06 · System Persistence

Error

• Location: SKILL.md:1066
• Finding: Default recurring report delivery creates cross-session persistence without prior opt-in<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 1066–1090 and 1124–1220 **Vulnerability Type**: Default scheduled-task persistence and unsolicited outbound delivery **Risk Level**: High ### Complete Code Snippet ```text Default Behavior After installing this Skill, automatic push is enabled by default and requires no additional configuration. WorkBuddy generates and pushes reports at the following three times on every trading day: 08:55 — Pre-market briefing 11:35 — Intraday snapshot 15:05 — Post-market review ``` The recurring task definitions include: ```text FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR;BYHOUR=8;BYMINUTE=55 FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR;BYHOUR=11;BYMINUTE=35 FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR;BYHOUR=15;BYMINUTE=5 ``` The corresponding automation instructions direct WorkBuddy to save each generated report and push it to a linked messaging destination, with WeChat preferred. ### Technical Analysis The Skill instructs the host agent to enable three recurring automations by default. These tasks survive the initiating interaction and continue generating files, performing network requests, and sending messages on later trading days. Scheduled execution is not necessary for the core declared function of generating a market report in response to a user request. It materially expands the Skill's privilege scope from an on-demand analysis operation to persistent execution and external communication. The documentation provides a later method for disabling the tasks, but post-installation opt-out does not replace informed consent before creating persistent automation. The repository does not contain standalone task-registration code; the risk arises from instructions intended to make the host Agent or WorkBuddy automation platform create the tasks. ### Attack Path 1. A user installs or initially invokes the Skill. 2. The Agent loads `SKILL.md` and follows its default-behavior instructions. 3. The Agent creates three weekly recurr ...[truncated 892 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable all scheduled delivery by default. 2. Require an explicit user request before creating any recurring task. 3. Present the schedule, data sources, output directory, and delivery destination before registration. 4. Require separate affirmative confirmation for each messaging destination. 5. Provide a list of the exact automation objects that will be created. 6. Make one-time report generation the default execution mode. 7. Add a visible command that lists, pauses, and deletes all tasks created by the Skill. 8. Ensure uninstalling the Skill removes associated scheduled tasks only after user confirmation. 9. Restrict automation permissions to report generation and the specifically approved destination. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:95
• Finding: Stored Tushare API token is transmitted over unencrypted HTTP<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 95–106, 122–141, and 214–229 **Vulnerability Type**: Plaintext credential transmission **Risk Level**: High ### Complete Code Snippet ```python TOKEN_FILE = Path.home() / '.tushare_token' def load_token(): """Read the token from the local file; return None when unavailable.""" if TOKEN_FILE.exists(): t = TOKEN_FILE.read_text(encoding='utf-8').strip() return t if t else None return None ``` Token validation sends the credential over HTTP: ```python body = json.dumps({ 'api_name': 'daily', 'token': token, 'params': { 'ts_code': '000001.SZ', 'start_date': '20240101', 'end_date': '20240103' }, 'fields': 'trade_date,close' }).encode() req = urllib.request.Request( 'http://api.tushare.pro', data=body, headers={'Content-Type': 'application/json'}, method='POST' ) with urllib.request.urlopen(req, timeout=15) as r: result = json.loads(r.read()) ``` Normal API requests repeat the same unsafe transport: ```python body = json.dumps({ 'api_name': api_name, 'token': TOKEN, 'params': params, 'fields': fields }).encode() req = urllib.request.Request( 'http://api.tushare.pro', data=body, headers={'Content-Type': 'application/json'}, method='POST' ) with urllib.request.urlopen(req, timeout=20) as r: result = json.loads(r.read()) ``` ### Technical Analysis The Skill reads a reusable API token from `~/.tushare_token`, embeds it in a JSON request body, and sends it to `http://api.tushare.pro`. HTTP provides neither transport encryption nor server authentication. An observer positioned on the local network, a corporate proxy, an upstream network, or a compromised gateway can read the token directly. An active attacker can also modify API responses, potentially corrupting the financial data subsequently included in reports. The Skill's accompanying claim that the token is n ...[truncated 1157 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace every Tushare endpoint with `https://api.tushare.pro`. 2. Reject redirects from HTTPS to HTTP. 3. Rely on normal certificate and hostname validation; do not disable TLS verification. 4. Remove the preliminary unauthenticated HTTP connectivity probe or convert it to HTTPS. 5. State accurately that the token is transmitted to Tushare for authentication but is not sent to unrelated services. 6. Create the token file with owner-only permissions, such as mode `0600` on supported systems. 7. Avoid printing the token or including it in exceptions, logs, subprocess arguments, or generated reports. 8. Recommend token rotation after any execution of the plaintext implementation on an untrusted network. 9. Add tests that reject non-HTTPS credential-bearing endpoints. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:172
• Finding: Setup instructions inject an undisclosed referral registration link<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 172–181 **Vulnerability Type**: Referral traffic diversion in Agent-generated setup output **Risk Level**: Medium ### Complete Code Snippet ```python if token is None: print('=' * 50) print('Tushare Token was not detected. Configuration is required:') print() print('Step 1: Register a free Tushare Pro account') print('Registration address: https://tushare.pro/register?reg=666') print() print('Step 2: Obtain the token after signing in') print('Token page: https://tushare.pro/user/token') ``` The same referral-bearing URL also appears in `README.md` at lines 78–81: ```text https://tushare.pro/register?reg=666 ``` ### Technical Analysis The `reg=666` query parameter is not required to explain how to create a Tushare account or obtain an API token. It is a referral-style identifier embedded in a setup flow that the Skill directs the Agent to present when no token is found. The Skill does not disclose the purpose of the parameter or whether the Skill author receives attribution, credit, traffic, or another benefit. This makes unrelated promotional or traffic-diversion behavior part of the Agent's output. A canonical registration URL would provide the same functional outcome with less influence over the user's navigation. ### Attack Path 1. The user invokes the Skill without a local Tushare token. 2. The startup logic enters the first-time setup branch. 3. The Agent or script displays the fixed registration URL. 4. The user follows the URL and registers. 5. Registration traffic is attributed through the embedded referral parameter. ### Impact Assessment This issue does not grant local system privileges. Its impact is output manipulation and undisclosed diversion of user traffic. It may: - Generate referral attribution for a third party. - Mislead users into believing the parameter is technically required. - Reduce user trust in Agent-generated setup ins ...[truncated 121 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the referral-bearing link with the canonical registration URL. 2. If a referral link is retained, clearly disclose that it is a referral and identify any benefit received. 3. Offer the canonical non-referral URL with equal prominence. 4. Do not force promotional links into generated reports or setup responses. 5. Restrict first-run output to information necessary to configure the requested data source. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: render_report.py:89
• Finding: Dynamically dated financial reports contain hard-coded and potentially stale market claims<![CDATA[ ## Vulnerability Details **File Location**: `render_report.py`, lines 89–215 **Vulnerability Type**: Financial-report data integrity failure and fabricated fallback content **Risk Level**: High ### Complete Code Snippet ```python template = template.replace('{{PREV_AMOUNT}}', '1.5') template = template.replace( '{{AMOUNT_CHANGE}}', f"Large volume increase +{(total_yi-1.5):.2f} trillion" ) ``` ```python template = template.replace( '{{SOUTH_MONEY}}', 'Southbound trading net sale of approximately HKD 14.1 billion' ) template = template.replace( '{{CENTRAL_BANK}}', 'Maintained CNY 800 billion in outright reverse-repurchase operations' ) ``` ```python zt = data.get('zt_cnt', 123) zbgc = data.get('zbgc_cnt', 16) emotion_rows = [ f"| Total limit-up stocks | **{zt}** | Sentiment is warm but healthy |", f"| Broken limit-up stocks | {zbgc} | — |", "| Advance/decline ratio | **16.6:1** | Recent high; extremely euphoric |", "| Sentiment rating | **Euphoric but healthy** | Broad advance and ample turnover |", ] ``` When fetched limit-up data is unavailable, a fixed stock list is inserted: ```python if not lianban_list: lianban_list = [ {'level': 4, 'name': '汇源通信', 'sector': '通信设备/CPO', 'mc_yi': 44}, {'level': 3, 'name': '中安科', 'sector': '软件开发/安防', 'mc_yi': 102}, {'level': 2, 'name': '中工国际', 'sector': '专业工程', 'mc_yi': 143}, {'level': 2, 'name': '金陵药业', 'sector': '化学制药', 'mc_yi': 55}, {'level': 2, 'name': '通鼎互联', 'sector': '通信设备', 'mc_yi': 179}, ] ``` The renderer also injects fixed geopolitical and commodity narratives: ```python hot_rows = [ "**Strongest theme: precious metals**", "Driver: a conditional two-week Middle East ceasefire, reopening of the Strait of Hormuz, an oil-price decline exceeding 19%, gold above USD 3,400 per ounce, and silver at USD 77.77 per ounce.", ] ``` ### Technical Analysis `render_report.py` combines a small number of fetched field ...[truncated 1953 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all hard-coded market facts, stock lists, capital flows, prior-day turnover, policy claims, and geopolitical narratives. 2. Attach a source and retrieval timestamp to every dynamic claim. 3. Represent missing data as unavailable rather than substituting plausible-looking defaults. 4. Fail report generation when mandatory fields are absent, or generate a clearly marked partial report. 5. Add schema validation for `fetch_data.json`, including freshness, expected trading date, field type, and source. 6. Reject stale data whose trading date does not match the intended report date. 7. Separate factual data from model-generated interpretation. 8. Require source-backed evidence for causal market narratives. 9. Add automated tests that simulate empty and partial fetch results and verify that no invented statistics appear. 10. Prevent automatic delivery when report validation fails. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:211
• Finding: Runtime dependencies are installed without exact version or integrity pinning<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 211–217 **Vulnerability Type**: Mutable third-party dependency resolution **Risk Level**: Medium ### Complete Code Snippet ```text Python >= 3.10 akshare >= 1.10.0 (pip install akshare) tushare >= 1.2.89 (optional; pip install tushare) baostock (optional; pip install baostock) ``` `SKILL.md` also gives the following installation instruction at line 365: ```text pip install akshare ``` ### Technical Analysis The project imports `akshare` directly in `fetch_review_v2.py`, but it provides no lockfile, exact version, package hashes, or isolated-environment requirement. A lower-bound constraint such as `akshare >= 1.10.0` allows any future release to be selected. Python packages execute code during installation and import. Consequently, the effective code executed by the Skill can change after the Skill itself has been reviewed. This is a supply-chain weakness even though the audit found no evidence that the named packages are currently malicious. The optional packages are similarly unpinned, and `baostock` has no version constraint at all. ### Attack Path 1. A user follows the documented `pip install` command. 2. The package resolver selects the latest version available from the configured package index. 3. A compromised account, malicious release, index compromise, or unsafe mirror supplies altered package code. 4. Package installation or later import executes that code in the user's Python environment. 5. The dependency receives the same filesystem and network permissions as the report scripts. ### Impact Assessment If the dependency supply chain is compromised, arbitrary Python code could execute with the privileges of the user running the Skill. That scope could include: - Reading files available to the current user. - Accessing the network. - Modifying report files or generated data. - Reading locally stored tokens, including `~/.tushare_token`. - Persisting thr ...[truncated 153 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every runtime dependency to an exact reviewed version. 2. Generate a lockfile with cryptographic hashes. 3. Install dependencies using hash enforcement, such as `pip install --require-hashes`. 4. Use a dedicated virtual environment rather than the user's global Python environment. 5. Document the trusted package index and reject unapproved mirrors. 6. Add automated dependency vulnerability and provenance scanning. 7. Review and deliberately update locked versions rather than allowing automatic latest-version resolution. 8. Minimize optional dependencies and remove packages not used by the executable scripts. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: This mismatch is more serious because the finding indicates hardcoded narratives and fabricated-looking fallback content despite claims that missing data is left blank. In a finance-reporting skill, undeclared synthesis of pseudo-factual market content can mislead users, propagate false information, and mask the absence of real data sources.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: This mismatch is more serious because the finding indicates hardcoded narratives and fabricated-looking fallback content despite claims that missing data is left blank. In a finance-reporting skill, undeclared synthesis of pseudo-factual market content can mislead users, propagate false information, and mask the absence of real data sources.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Automatic scheduling, file creation, and message pushing are enabled by default without prominent upfront consent for ongoing side effects. This can lead to silent persistence and repeated outbound data transmission, which is especially risky in a skill that reads previous files and writes reports autonomously.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation claims the token is not uploaded to any cloud, but the code necessarily transmits it over the network to the Tushare API for authentication. This is a misleading security assurance around credential handling, and users may provide secrets under false assumptions about where they travel.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The renderer hardcodes market narratives, fallback figures, and interpretive statements even when data may be missing, contradicting the skill contract that missing fields should be left blank and not fabricated. In a finance context, this can mislead users into acting on invented or stale content presented as current analysis, creating integrity and trust risks.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This section provides action-oriented trading guidance such as sectors to watch, low-level follow-up opportunities, and conditions for participation, which exceeds the stated scope and moves into recommendation behavior. In a market-review skill, such advice can drive user financial decisions without suitability controls, disclosures, or authorization, making the context more dangerous.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The README frames the skill as optimized for WeChat mobile reading and the report format examples are centered on Chinese-market conventions and Chinese-language presentation. There is no explicit opt-in or user-selectable language/locale behavior, which can violate language/locale policy when a skill effectively forces a specific presentation style by default.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README states that daily auto-push is enabled immediately after installation and that reports are sent to linked messaging channels such as WeChat or WhatsApp. That creates default data transmission to third-party destinations without explicit opt-in, consent, or a clear privacy warning about what content will be sent and where it will be stored, which is a legitimate privacy and safety issue.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documents and embeds capabilities for local file reads/writes, network access, and shell/Python execution but does not declare an explicit tool scope or permission boundary. In an agent environment, this increases the chance of over-broad execution, accidental misuse, or abuse through prompt-triggered invocation because the runtime has more power than the manifest advertises.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are broad and overlap with normal conversation about markets, creating a meaningful risk of accidental invocation. Because this skill can perform network access, file creation, automation, and outbound delivery, unintended triggering is more dangerous than it would be for a read-only helper.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as a reporting tool, but it also performs default auto-push to external messaging endpoints. That is a broader action surface than passive report generation and can exfiltrate generated or propagated content to third-party channels without a fresh per-use confirmation.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Default scheduled automation plus message delivery extends the skill from on-demand analysis into persistent autonomous operation. In an agent setting, this increases blast radius by creating recurring file writes, repeated network access, and repeated outbound delivery without requiring contemporaneous user intent.

Ssd 3

Medium

• Confidence: 89% confidence
• Finding: The automation reads previously generated report files and reuses their contents in later outputs that may be pushed to external messaging endpoints. This creates a natural-language propagation channel where tainted, incorrect, or unexpectedly sensitive content can persist across runs and be redistributed automatically.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The file defines user-facing control phrases and first-run setup text only in Chinese, and multiple report templates are written as fixed Chinese output formats. This creates a language policy issue because the skill effectively assumes a specific language rather than offering the user a language or locale choice.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest and earlier sections describe a strict fallback chain of Tushare Pro, then AKShare, then search-engine retrieval, with missing data left blank. Later sections introduce direct Sina Finance scraping, BaoStock fallback, JSON intermediate files, template/render scripts, and hardcoded fallback behavior, which materially expands operational behavior beyond the advertised 3-tier architecture.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The module docstring states this is a "盘后复盘数据获取脚本" and the implementation only fetches end-of-day style market data such as closing indexes,涨停池,北向资金,市场情绪, and sector flows. There is no code for pre-market briefing, intraday snapshot generation, or the declared third-tier search-engine fallback; this materially under-implements the broader manifest description.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module docstring and all user-facing messages are explicitly in Chinese, indicating a fixed language/locale behavior. There is no indication that the user can opt into another language or that the Chinese-only constraint is documented as a justified region-specific requirement.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The section header and log messages say "降级搜索" when sector flow fetching fails, implying a real fallback to search. In practice, the code just catches the exception, sets `sector_ok = False`, and proceeds without any search request, so the inline documentation actively misstates behavior.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This code file contains natural-language strings exclusively in Chinese, including the top-level description and runtime messages, with no indication that the skill is China-region-specific or that users can opt into the language. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 先删除旧文件（如果有）
    if JSON_OUT.exists():
        JSON_OUT.unlink()
    result = subprocess.run(
        [sys.executable, str(FETCH_SCRIPT)],
        capture_output=True,
        text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The script writes fetch_data.json to disk via JSON_OUT.write_text(), which is a file-modifying operation. Although the script prints after the write succeeds, there is no prior warning, confirmation prompt, or comment/docstring near the write indicating this side effect to the user.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The entire report template is written in Chinese and does not mention any option to select another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified.

Static analysis

No suspicious patterns detected.