Security audit

A股股市盘前盘中盘后分析/china-stocks-daily-review

Security checks for vulnerabilities and agentic risk

Overview

This skill is for A-share market reports, but it needs review because it enables recurring external delivery by default, handles a local API token insecurely, and can produce current-dated financial reports with hard-coded claims.

Install only if you want default scheduled A-share reports and understand they may be saved locally and sent to linked messaging channels. Disable auto-push unless you explicitly want recurring delivery, avoid using a Tushare token until the endpoint uses HTTPS, treat generated market narratives as unverified, and run the Python dependencies in an isolated environment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T06 · System Persistence

Error

Location: SKILL.md:1067
Finding: Opt-Out Scheduled Tasks Create Cross-Session Persistence and Unsolicited External Delivery
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:122
Finding: Tushare API Token Is Transmitted over Unencrypted HTTP
Content: View full analysis
tuple[bool, str]: """ Validate the token by calling the daily endpoint. Returns (is_valid, message). """ try: body = json.dumps({ 'api_name': 'daily', 'token': token, 'params': { 'ts_code': '000001.SZ', 'start_date': '20240101', 'end_date': '20240103' }, 'fields': 'trade_date,close' }).encode() req = urllib.request.Request( 'http://api.tushare.pro', data=body, headers={'Content-Type': 'application/json'}, method='POST' ) with urllib.request.urlopen(req, timeout=15) as r: result = json.loads(r.read()) ``` The same insecure transport is used for normal API requests at `SKILL.md:217-229`: ```python body = json.dumps({ 'api_name': api_name, 'token': TOKEN, 'params': params, 'fields': fields }).encode() req = urllib.request.Request( 'http://api.tushare.pro', data=body, headers={'Content-Type': 'application/json'}, method='POST' ) with urllib.request.urlopen(req, timeout=20) as r: result = json.loads(r.read()) ``` ### Technical Analysis The Skill reads a credential from `~/.tushare_token` and places it in a JSON request body sent to `http://api.tushare.pro`. HTTP provides neither transport confidentiality nor reliable endpoint authentication. A network-positioned attacker can observe the request body, recover the Tushare token, alter API responses, or impersonate the endpoint. Relevant threat positions include an untrusted wireless network, compromised router, malicious proxy, or any intermediary able to observe or modify plaintext traffic. The documentation states that the ...[truncated 1166 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:171
Finding: Token Setup Injects an Undisclosed Affiliate Registration Link
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:214
Finding: Mutable and Unverified Third-Party Python Dependencies
Content: View full analysis
= 1.10.0 (pip install akshare) tushare >= 1.2.89 (optional; pip install tushare; requires the user's token) baostock (optional; pip install baostock; fallback index source) ``` The Skill also gives the following unrestricted installation direction at `SKILL.md:365`: ```text pip install akshare ``` ### Technical Analysis The installation guidance allows mutable package releases to be resolved from the configured Python package index. A lower-bound version such as `akshare >= 1.10.0` accepts any future version, while `baostock` has no version constraint at all. No lock file, package hash, trusted index constraint, or reproducible environment is provided. Python packages and their build systems can execute code during installation or import. Consequently, compromise of an upstream package, dependency account, package index, or transitive dependency can introduce code that runs with the user's privileges. The audit did not find evidence that the named packages are malicious. The vulnerability is the unsafe and non-reproducible dependency acquisition process. ### Attack Path 1. A user follows the documented `pip install` commands. 2. The package resolver selects the latest package and transitive dependency versions allowed by the broad constraints. 3. An upstream package or dependency has been compromised, replaced, or maliciously updated. 4. Installation hooks or imported package code execute in the user's environment. 5. The malicious dependency obtains the same filesystem and network privileges as the Python process. ### Impact Assessment A compromised dependency can execute arbitrary Python code with the privileges of the user running the installation or report scripts. Depending on those privileges, it could r ...[truncated 297 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: render_report.py:89
Finding: Current-Dated Financial Reports Mix Live Values with Hard-Coded Market Claims
Content: View full analysis
2 else 'Active participation' ) core = ( f"A Middle East ceasefire triggered a global risk-on move, " f"A-shares rose sharply on higher volume, " f"{sh_status}, and STAR 50 rose {cy_pct:.1f}% to lead the market" ) template = template.replace('{{CORE_THEME}}', core) template = template.replace( '{{SOUTH_MONEY}}', 'Stock Connect southbound net selling was approximately HKD 14.1 billion' ) template = template.replace( '{{CENTRAL_BANK}}', 'The central bank maintained CNY 800 billion of outright reverse repos' ) emotion_rows = [ f"| Total limit-up stocks | **{zt}** | Sentiment is hot but healthy |", f"| Failed limit-ups | {zbgc} | — |", f"| Failure rate | **{rate:.1f}%** | Healthy range |", "| Advance/decline ratio | **16.6:1** | Recent high; extremely exuberant |", "| Sentiment rating | **Exuberant but healthy** | Broad gains and ample volume |", ] ``` Additional fixed event, commodity-price, sector, stock, and strategy assertions are inserted at `render_report.py:168-203`, including statements about a ceasefire, oil prices, gold and silver prices, specific stocks, and preferred trading themes. ### Technical Analysis The renderer labels its output with the current date but obtains only part of the report from live data. It then combines those values with fixed constants and narrative claims that are not tied to the fetch date or validated against a source. Examples include a fixed previous turnover value, a fixed advance/decline ...[truncated 1466 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The description and code are partially related—both concern A-share market review data—but the implementation is materially narrower and differs in important ways. The script is explicitly a ‘盘后复盘数据获取脚本’ and fetches only post-close metrics. It does not implement pre-market or intraday report logic, nor does it generate the three promised report types. The advertised data architecture is also inaccurate for this code: there is no Tushare usage, and no actual search-engine scraping fallback is implemented. Additionally, southbound funds are declared but absent. While some mentioned data elements are present (market sentiment, sector rotation proxy, limit-up ladder, northbound flow, turnover), the declared description overstates both scope and architecture compared with the observed behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The general domain matches A-share market review/report generation, but the declared description overstates and misstates what this code chunk actually does. The script specifically renders a post-market report (report_{TODAY}_postmarket_auto.md) and contains post-close recap content such as 涨停统计、连板梯队、今日小结、明日观察. There is no visible branching for pre-market or intraday report generation. The declared 3-tier fallback data architecture is also not represented here; instead, this script invokes a local fetch script and falls back only to crude stdout parsing, so the described resource access pattern is not accurate for this code chunk. Finally, the description says missing data is left blank and never fabricated, but this renderer injects substantial hardcoded content and fallback stock lists/market commentary (e.g., north/south money text, central bank text, sector themes, strategies, default counts), which is materially different from a strict blank-on-missing behavior. Therefore this is a meaningful description-behavior mismatch.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill enables unsolicited auto-push to external messaging endpoints by default, which creates an outbound data exfiltration channel and can spam or leak content without a fresh user action each time. In an agent setting, default external delivery is especially risky because reports may include inferred user interests, prior generated content, or data from local context and be transmitted automatically.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Automatic push and local report creation are enabled by default without clear upfront consent for persistent writes and outbound delivery. This is dangerous because users may believe they are invoking a one-shot analysis skill while it silently establishes recurring tasks, stores artifacts, and transmits outputs externally.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill metadata promises that missing data will be left blank and never fabricated, but this renderer injects hardcoded market narratives, fallback stock ladders, fixed资金/宏观 commentary, and tactical conclusions when data is absent or partial. In a financial-analysis skill, this is dangerous because users may treat fabricated or stale content as current market intelligence, leading to misleading reports and potentially harmful decisions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README states the skill will determine report generation based on user input or current time, but it does not clearly define invocation boundaries, consent requirements, or when autonomous behavior is allowed. In an agent setting, ambiguous trigger conditions can cause unintended execution and data retrieval, especially when combined with scheduled automation and outbound messaging.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill enables daily auto-push by default and sends reports to linked messaging channels, but the warning about outbound transmission is buried in the feature description rather than presented as explicit consent language. This creates a real risk of unanticipated external data transmission, especially if reports contain user-linked context, account-specific outputs, or sensitive workflow metadata.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documents and embeds capabilities for local file reads/writes, network access, and shell/script execution, but does not declare any tool scope or permission boundaries. In an agent environment, this broad undeclared capability increases the chance of over-privileged execution, surprising side effects, and misuse of local or external resources beyond what a user expects from a market-reporting skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are broad enough to match ordinary market conversation, increasing the risk of unintended invocation. Because this skill includes automation, file persistence, network access, and possible outbound delivery, accidental triggering is more dangerous than in a purely local, read-only skill.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Early documentation promises a fixed 3-tier fallback of Tushare Pro → AKShare → search engine. Later optimization rules explicitly replace that order for index data with Sina Finance first, including recommendations to skip unstable AKShare and use Sina directly, which contradicts the declared data-architecture intent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest-level principle says missing data should be left blank and not invented. However, the cross-validation rules for search fallback instruct choosing a middle or conservative value when multiple sources disagree, which introduces synthesized values not directly present in a source and conflicts with the non-fabrication claim.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Throughout the instructions and templates, the report structure, trigger words, and required output format are defined in Chinese, and the templates mandate Chinese presentation conventions for generated reports. The file does not clearly offer users a language-selection option or state that Chinese output is optional, which can violate a language/locale choice policy.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill expands from on-demand report generation into automation, persistence, and message delivery, materially increasing its operational scope. Scope expansion is dangerous because it adds unattended execution and data movement pathways that users may not anticipate, especially when coupled with local file storage and outbound notifications.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Default automatic pushes to bound messaging channels can disclose generated reports, user preferences, and potentially contextual data to external endpoints without explicit per-send authorization. The risk is amplified by the skill's automation model, because disclosure can recur on a schedule and may reach third-party messaging infrastructure outside the user's immediate view.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The automation instructions repeatedly save reports to local files without a clear warning about ongoing workspace modification. Repeated writes can accumulate sensitive or proprietary content over time, expand local disclosure risk, and surprise users who expected ephemeral outputs.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Reading prior locally saved reports introduces local file access beyond the minimum needed for generating a new report, and it creates a pathway for unintended reuse of stored content. This becomes dangerous when chained with automated outputs, because historical data can be re-ingested and propagated without the user realizing prior files are part of the prompt context.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documented workflow chains local file reads with downstream message delivery, creating a gradual disclosure path where previously stored report content can be reintroduced and sent externally. This kind of multi-step data flow is risky because each individual action may seem benign, but together they enable propagation of historical local content beyond its original context.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The workflow directs creation and execution of local Python, JSON, and template pipeline files, increasing attack surface through script execution and persistent artifacts not central to the stated analysis role. In agent environments, extra executable tooling can be repurposed or modified to perform unintended actions, especially when shell and file-write capabilities are already present.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring explicitly describes this file as a "盘后复盘数据获取脚本" and the implemented logic fetches closing indexes, limit-up statistics, northbound flow, sector performance, and writes a JSON snapshot for later rendering. There is no code here supporting the manifest's broader claim of generating pre-market briefings or intraday snapshots, so the actual behavior in this file is materially narrower than the skill description.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file's docstrings and all user-facing print output are written in Chinese, and the script provides no option to select another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest emphasizes a 3-tier fallback ending in search-engine retrieval, and the inline logging/comment says "超时3秒降级搜索" / "降级搜索" when sector data retrieval fails. In reality, the exception path only sets sector_ok = False and df_sector = None; no search request or alternate retrieval is attempted, so the documentation and runtime messages contradict the implemented behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file contains natural-language instructions and status text that force a specific language/locale for users. Under the policy, locale constraints should either provide user opt-in/choice or be clearly justified as region-specific; neither is present here.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · render_report.py (reported line 33)May include surrounding context.
python
# 先删除旧文件（如果有） if JSON_OUT.exists(): JSON_OUT.unlink() result = subprocess.run( [sys.executable, str(FETCH_SCRIPT)], capture_output=True, text=True,

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code emits stock-specific tactical guidance such as watching named equities for opening premium or '低位补涨机会', despite the skill declaring stock-picking and deep individual-stock analysis out of scope. In the context of a market-review skill, this broadens the tool into quasi-investment advice without appropriate controls, increasing the chance of users relying on unsupported recommendations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest describes generation of three report types: pre-market, intraday, and post-market. This script always writes a file named 'report__postmarket_auto.md' and its content is structured around post-market recap sections, with no branching or parameterization for the other two declared report modes.
Content: No source excerpt is available for this finding.