A股股市盘前盘中盘后分析/china-stocks-daily-review

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:33 AM UTC
• Version: 1.0.1

Overview

This skill is for A-share market reports, but it needs review because it enables recurring external delivery by default, handles a local API token insecurely, and can produce current-dated financial reports with hard-coded claims.

Install only if you want default scheduled A-share reports and understand they may be saved locally and sent to linked messaging channels. Disable auto-push unless you explicitly want recurring delivery, avoid using a Tushare token until the endpoint uses HTTPS, treat generated market narratives as unverified, and run the Python dependencies in an isolated environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T06 · System Persistence

Error

• Location: SKILL.md:1067
• Finding: Opt-Out Scheduled Tasks Create Cross-Session Persistence and Unsolicited External Delivery<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:1067-1087` **Vulnerability Type**: Persistent scheduled automation enabled without prior consent **Risk Level**: High ### Vulnerable Code Snippet ```markdown ## Automatic Push: Scheduled Report Delivery ### Default Behavior After this Skill is installed, automatic delivery is enabled by default without additional configuration. WorkBuddy automatically generates and delivers reports at the following three times on every trading day: | Time | Report type | Description | |-----|---------|------| | 08:55 | Pre-market market overview | Generated before the market opens | | 11:35 | Intraday market commentary | Generated after the midday close | | 15:05 | Post-market review | Generated after the market closes | Reports are delivered to messaging channels linked to the user's WorkBuddy account, including WeChat, WhatsApp, or another configured destination. If no channel is linked, the report is emitted in the current conversation. ``` The corresponding task definitions at `SKILL.md:1119-1204` provide recurring rules and instruct the platform to deliver each generated report externally. For example: ```text FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR;BYHOUR=8;BYMINUTE=55 FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR;BYHOUR=11;BYMINUTE=35 FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR;BYHOUR=15;BYMINUTE=5 ``` ### Technical Analysis The Skill instructs the host Agent to create three recurring automation tasks that survive the initiating session. These tasks repeatedly invoke network-backed report generation and send the resulting content to messaging channels associated with the user. Recurring delivery can be a legitimate optional feature, but enabling it by default exceeds the minimum privileges required to answer an interactive request for a market report. A one-time market analysis does not require persistent schedules or access to external messaging destinations. No local scheduler implementation is present in the Python scripts. ...[truncated 1439 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make all scheduled delivery features disabled by default. 2. Require explicit, informed opt-in before creating any recurring task. 3. Present the exact schedule, report type, destination, expected network activity, and retention behavior before approval. 4. Request separate consent for every external messaging destination. 5. Allow users to generate reports interactively without granting scheduler or messaging permissions. 6. Provide a single command that deletes all associated tasks rather than merely pausing them. 7. Verify and report whether task deletion succeeded. 8. Ensure installation and first invocation never modify automation state. 9. Add a visible list of active tasks and their next execution times. 10. Apply least privilege so scheduled tasks can access only the data sources and destination approved by the user. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:122
• Finding: Tushare API Token Is Transmitted over Unencrypted HTTP<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:122-141` **Vulnerability Type**: Plaintext transmission of an API credential **Risk Level**: High ### Vulnerable Code Snippet ```python def verify_token(token: str) -> tuple[bool, str]: """ Validate the token by calling the daily endpoint. Returns (is_valid, message). """ try: body = json.dumps({ 'api_name': 'daily', 'token': token, 'params': { 'ts_code': '000001.SZ', 'start_date': '20240101', 'end_date': '20240103' }, 'fields': 'trade_date,close' }).encode() req = urllib.request.Request( 'http://api.tushare.pro', data=body, headers={'Content-Type': 'application/json'}, method='POST' ) with urllib.request.urlopen(req, timeout=15) as r: result = json.loads(r.read()) ``` The same insecure transport is used for normal API requests at `SKILL.md:217-229`: ```python body = json.dumps({ 'api_name': api_name, 'token': TOKEN, 'params': params, 'fields': fields }).encode() req = urllib.request.Request( 'http://api.tushare.pro', data=body, headers={'Content-Type': 'application/json'}, method='POST' ) with urllib.request.urlopen(req, timeout=20) as r: result = json.loads(r.read()) ``` ### Technical Analysis The Skill reads a credential from `~/.tushare_token` and places it in a JSON request body sent to `http://api.tushare.pro`. HTTP provides neither transport confidentiality nor reliable endpoint authentication. A network-positioned attacker can observe the request body, recover the Tushare token, alter API responses, or impersonate the endpoint. Relevant threat positions include an untrusted wireless network, compromised router, malicious proxy, or any intermediary able to observe or modify plaintext traffic. The documentation states that the ...[truncated 1166 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace every `http://api.tushare.pro` endpoint with `https://api.tushare.pro`. 2. Reject redirects that downgrade HTTPS requests to HTTP. 3. Retain normal TLS certificate and hostname verification; do not add permissive SSL contexts. 4. Store the token in an operating-system credential manager where available. 5. If a file must be used, create it with owner-only permissions and verify those permissions before reading it. 6. Avoid keeping the token in global variables longer than necessary. 7. Never include token values in exceptions, logs, generated reports, or subprocess output. 8. Correct the documentation to state that the token is transmitted to Tushare for authentication but is not sent to unrelated services. 9. Recommend token rotation after upgrading from the insecure implementation. 10. Add an automated test that fails if any credential-bearing endpoint uses an `http://` URL. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:171
• Finding: Token Setup Injects an Undisclosed Affiliate Registration Link<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:171-189` **Vulnerability Type**: Promotional traffic diversion embedded in Agent output **Risk Level**: Medium ### Vulnerable Code Snippet ```python if token is None: print('=' * 50) print('Tushare Token was not detected. Complete the following setup:') print() print('Step 1: Register for a free Tushare Pro account') print('Registration URL: https://tushare.pro/register?reg=666') print() print('Step 2: Obtain a token after signing in') print('Token page: https://tushare.pro/user/token') print() print('Step 3: Save the token locally') print('=' * 50) print('This automated environment cannot accept interactive token input.') print('Run the following command in a terminal and then regenerate the report:') print() print( "python -c \"from pathlib import Path; " "Path.home().joinpath('.tushare_token').write_text('YOUR_TOKEN_HERE')\"" ) ``` The same referral parameter also appears in the setup documentation at `README.md:78`. ### Technical Analysis The registration URL contains the fixed parameter `reg=666`, which attributes or redirects registrations through a referral identifier. That parameter is not required to obtain a Tushare account or token and does not support the declared market-reporting functionality. Because the setup guidance is emitted when no token is present, ordinary configuration output is used to promote a fixed third-party referral. The Skill does not disclose the referral relationship or give the user a neutral canonical registration option. This is an instruction-level output manipulation issue rather than arbitrary code execution. It alters what the Agent presents during setup for the publisher's potential promotional benefit. ### Attack Path 1. The Skill checks `~/.tushare_token`. 2. No token is found. 3. The mandatory setup flow displays the fixed URL containing `reg=666`. 4. The user follows ...[truncated 499 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the referral URL with Tushare's canonical registration page without query parameters. 2. If a referral relationship is retained, disclose it clearly before presenting the link. 3. Provide a neutral non-referral URL with equal prominence. 4. Do not make promotional content part of mandatory setup output. 5. Separate sponsorship or commercial material from operational instructions. 6. Add review checks that reject unexplained referral, campaign, or tracking parameters in Skill-generated output. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:214
• Finding: Mutable and Unverified Third-Party Python Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `README.md:214-216` **Vulnerability Type**: Unpinned dependency installation without integrity verification **Risk Level**: Medium ### Vulnerable Code Snippet ```text akshare >= 1.10.0 (pip install akshare) tushare >= 1.2.89 (optional; pip install tushare; requires the user's token) baostock (optional; pip install baostock; fallback index source) ``` The Skill also gives the following unrestricted installation direction at `SKILL.md:365`: ```text pip install akshare ``` ### Technical Analysis The installation guidance allows mutable package releases to be resolved from the configured Python package index. A lower-bound version such as `akshare >= 1.10.0` accepts any future version, while `baostock` has no version constraint at all. No lock file, package hash, trusted index constraint, or reproducible environment is provided. Python packages and their build systems can execute code during installation or import. Consequently, compromise of an upstream package, dependency account, package index, or transitive dependency can introduce code that runs with the user's privileges. The audit did not find evidence that the named packages are malicious. The vulnerability is the unsafe and non-reproducible dependency acquisition process. ### Attack Path 1. A user follows the documented `pip install` commands. 2. The package resolver selects the latest package and transitive dependency versions allowed by the broad constraints. 3. An upstream package or dependency has been compromised, replaced, or maliciously updated. 4. Installation hooks or imported package code execute in the user's environment. 5. The malicious dependency obtains the same filesystem and network privileges as the Python process. ### Impact Assessment A compromised dependency can execute arbitrary Python code with the privileges of the user running the installation or report scripts. Depending on those privileges, it could r ...[truncated 297 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to an exact reviewed version. 2. Generate a lock file that also fixes transitive dependency versions. 3. Require cryptographic hashes for downloaded distributions, such as through `pip --require-hashes`. 4. Document the trusted package index and disable unexpected extra indexes. 5. Prefer isolated virtual environments with no access to unrelated project secrets. 6. Review release notes and source changes before updating dependency pins. 7. Run dependency vulnerability and provenance scanning in continuous integration. 8. Remove optional packages from default installation instructions unless their functionality is explicitly requested. 9. Publish a tested compatibility matrix and reproducible installation procedure. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: render_report.py:89
• Finding: Current-Dated Financial Reports Mix Live Values with Hard-Coded Market Claims<![CDATA[ ## Vulnerability Details **File Location**: `render_report.py:89-203` **Vulnerability Type**: Stale or fabricated factual data in dynamically dated financial output **Risk Level**: High ### Vulnerable Code Snippet ```python template = template.replace('{{PREV_AMOUNT}}', '1.5') template = template.replace( '{{AMOUNT_CHANGE}}', f"Large volume increase of {(total_yi - 1.5):.2f} trillion" ) template = template.replace( '{{FUND_MOOD}}', 'Rapid inflow' if total_yi > 2 else 'Active participation' ) core = ( f"A Middle East ceasefire triggered a global risk-on move, " f"A-shares rose sharply on higher volume, " f"{sh_status}, and STAR 50 rose {cy_pct:.1f}% to lead the market" ) template = template.replace('{{CORE_THEME}}', core) template = template.replace( '{{SOUTH_MONEY}}', 'Stock Connect southbound net selling was approximately HKD 14.1 billion' ) template = template.replace( '{{CENTRAL_BANK}}', 'The central bank maintained CNY 800 billion of outright reverse repos' ) emotion_rows = [ f"| Total limit-up stocks | **{zt}** | Sentiment is hot but healthy |", f"| Failed limit-ups | {zbgc} | — |", f"| Failure rate | **{rate:.1f}%** | Healthy range |", "| Advance/decline ratio | **16.6:1** | Recent high; extremely exuberant |", "| Sentiment rating | **Exuberant but healthy** | Broad gains and ample volume |", ] ``` Additional fixed event, commodity-price, sector, stock, and strategy assertions are inserted at `render_report.py:168-203`, including statements about a ceasefire, oil prices, gold and silver prices, specific stocks, and preferred trading themes. ### Technical Analysis The renderer labels its output with the current date but obtains only part of the report from live data. It then combines those values with fixed constants and narrative claims that are not tied to the fetch date or validated against a source. Examples include a fixed previous turnover value, a fixed advance/decline ...[truncated 1466 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove every hard-coded factual market, geopolitical, liquidity, price, and sentiment assertion. 2. Populate factual fields only from timestamped source data retrieved for the requested reporting period. 3. Represent unavailable values as unavailable rather than substituting historical examples. 4. Distinguish sample templates from production report-generation code. 5. Store source name, retrieval time, market date, and freshness limits with every value. 6. Reject data whose source date does not match the report date. 7. Fail closed when required report fields cannot be validated. 8. Add schema validation to ensure placeholders cannot silently receive fallback constants. 9. Add tests that generate reports for multiple dates and detect repeated factual narratives or unexplained constants. 10. Require citations for event-driven sector explanations and ensure cited content is contemporaneous. 11. Avoid prescriptive investment language unless it is clearly separated from verified factual reporting and accompanied by an appropriate risk notice. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The description and code are partially related—both concern A-share market review data—but the implementation is materially narrower and differs in important ways. The script is explicitly a ‘盘后复盘数据获取脚本’ and fetches only post-close metrics. It does not implement pre-market or intraday report logic, nor does it generate the three promised report types. The advertised data architecture is also inaccurate for this code: there is no Tushare usage, and no actual search-engine scraping fallback is implemented. Additionally, southbound funds are declared but absent. While some mentioned data elements are present (market sentiment, sector rotation proxy, limit-up ladder, northbound flow, turnover), the declared description overstates both scope and architecture compared with the observed behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The general domain matches A-share market review/report generation, but the declared description overstates and misstates what this code chunk actually does. The script specifically renders a post-market report (`report_{TODAY}_postmarket_auto.md`) and contains post-close recap content such as 涨停统计、连板梯队、今日小结、明日观察. There is no visible branching for pre-market or intraday report generation. The declared 3-tier fallback data architecture is also not represented here; instead, this script invokes a local fetch script and falls back only to crude stdout parsing, so the described resource access pattern is not accurate for this code chunk. Finally, the description says missing data is left blank and never fabricated, but this renderer injects substantial hardcoded content and fallback stock lists/market commentary (e.g., north/south money text, central bank text, sector themes, strategies, default counts), which is materially different from a strict blank-on-missing behavior. Therefore this is a meaningful description-behavior mismatch.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill enables unsolicited auto-push to external messaging endpoints by default, which creates an outbound data exfiltration channel and can spam or leak content without a fresh user action each time. In an agent setting, default external delivery is especially risky because reports may include inferred user interests, prior generated content, or data from local context and be transmitted automatically.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Automatic push and local report creation are enabled by default without clear upfront consent for persistent writes and outbound delivery. This is dangerous because users may believe they are invoking a one-shot analysis skill while it silently establishes recurring tasks, stores artifacts, and transmits outputs externally.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill metadata promises that missing data will be left blank and never fabricated, but this renderer injects hardcoded market narratives, fallback stock ladders, fixed资金/宏观 commentary, and tactical conclusions when data is absent or partial. In a financial-analysis skill, this is dangerous because users may treat fabricated or stale content as current market intelligence, leading to misleading reports and potentially harmful decisions.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The README states the skill will determine report generation based on user input or current time, but it does not clearly define invocation boundaries, consent requirements, or when autonomous behavior is allowed. In an agent setting, ambiguous trigger conditions can cause unintended execution and data retrieval, especially when combined with scheduled automation and outbound messaging.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill enables daily auto-push by default and sends reports to linked messaging channels, but the warning about outbound transmission is buried in the feature description rather than presented as explicit consent language. This creates a real risk of unanticipated external data transmission, especially if reports contain user-linked context, account-specific outputs, or sensitive workflow metadata.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documents and embeds capabilities for local file reads/writes, network access, and shell/script execution, but does not declare any tool scope or permission boundaries. In an agent environment, this broad undeclared capability increases the chance of over-privileged execution, surprising side effects, and misuse of local or external resources beyond what a user expects from a market-reporting skill.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger phrases are broad enough to match ordinary market conversation, increasing the risk of unintended invocation. Because this skill includes automation, file persistence, network access, and possible outbound delivery, accidental triggering is more dangerous than in a purely local, read-only skill.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: Early documentation promises a fixed 3-tier fallback of Tushare Pro → AKShare → search engine. Later optimization rules explicitly replace that order for index data with Sina Finance first, including recommendations to skip unstable AKShare and use Sina directly, which contradicts the declared data-architecture intent.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The manifest-level principle says missing data should be left blank and not invented. However, the cross-validation rules for search fallback instruct choosing a middle or conservative value when multiple sources disagree, which introduces synthesized values not directly present in a source and conflicts with the non-fabrication claim.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: Throughout the instructions and templates, the report structure, trigger words, and required output format are defined in Chinese, and the templates mandate Chinese presentation conventions for generated reports. The file does not clearly offer users a language-selection option or state that Chinese output is optional, which can violate a language/locale choice policy.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill expands from on-demand report generation into automation, persistence, and message delivery, materially increasing its operational scope. Scope expansion is dangerous because it adds unattended execution and data movement pathways that users may not anticipate, especially when coupled with local file storage and outbound notifications.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Default automatic pushes to bound messaging channels can disclose generated reports, user preferences, and potentially contextual data to external endpoints without explicit per-send authorization. The risk is amplified by the skill's automation model, because disclosure can recur on a schedule and may reach third-party messaging infrastructure outside the user's immediate view.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The automation instructions repeatedly save reports to local files without a clear warning about ongoing workspace modification. Repeated writes can accumulate sensitive or proprietary content over time, expand local disclosure risk, and surprise users who expected ephemeral outputs.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Reading prior locally saved reports introduces local file access beyond the minimum needed for generating a new report, and it creates a pathway for unintended reuse of stored content. This becomes dangerous when chained with automated outputs, because historical data can be re-ingested and propagated without the user realizing prior files are part of the prompt context.

Ssd 4

Medium

• Confidence: 90% confidence
• Finding: The documented workflow chains local file reads with downstream message delivery, creating a gradual disclosure path where previously stored report content can be reintroduced and sent externally. This kind of multi-step data flow is risky because each individual action may seem benign, but together they enable propagation of historical local content beyond its original context.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The workflow directs creation and execution of local Python, JSON, and template pipeline files, increasing attack surface through script execution and persistent artifacts not central to the stated analysis role. In agent environments, extra executable tooling can be repurposed or modified to perform unintended actions, especially when shell and file-write capabilities are already present.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The module docstring explicitly describes this file as a "盘后复盘数据获取脚本" and the implemented logic fetches closing indexes, limit-up statistics, northbound flow, sector performance, and writes a JSON snapshot for later rendering. There is no code here supporting the manifest's broader claim of generating pre-market briefings or intraday snapshots, so the actual behavior in this file is materially narrower than the skill description.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The file's docstrings and all user-facing print output are written in Chinese, and the script provides no option to select another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The manifest emphasizes a 3-tier fallback ending in search-engine retrieval, and the inline logging/comment says "超时3秒降级搜索" / "降级搜索" when sector data retrieval fails. In reality, the exception path only sets `sector_ok = False` and `df_sector = None`; no search request or alternate retrieval is attempted, so the documentation and runtime messages contradict the implemented behavior.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This file contains natural-language instructions and status text that force a specific language/locale for users. Under the policy, locale constraints should either provide user opt-in/choice or be clearly justified as region-specific; neither is present here.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 先删除旧文件（如果有）
    if JSON_OUT.exists():
        JSON_OUT.unlink()
    result = subprocess.run(
        [sys.executable, str(FETCH_SCRIPT)],
        capture_output=True,
        text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code emits stock-specific tactical guidance such as watching named equities for opening premium or '低位补涨机会', despite the skill declaring stock-picking and deep individual-stock analysis out of scope. In the context of a market-review skill, this broadens the tool into quasi-investment advice without appropriate controls, increasing the chance of users relying on unsupported recommendations.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The manifest describes generation of three report types: pre-market, intraday, and post-market. This script always writes a file named 'report_<date>_postmarket_auto.md' and its content is structured around post-market recap sections, with no branching or parameterization for the other two declared report modes.

Static analysis

No suspicious patterns detected.