虾皮市场温度指标分析

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:17 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent market-analysis helper, but it tells users to run mutable remote npm code while handling an API token and documents unsafe token-storage and token-in-URL patterns.

Review before installing. Use this only in an environment where you are comfortable running the DAXIAPI CLI, preferably pinned to a reviewed exact version instead of `@latest`. Avoid putting the token in URLs, shell history, transcripts, or startup files; prefer a bearer header or a protected secret manager flow. Treat the investment output as general market commentary, not personalized financial advice.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:68

Finding

Unpinned npm Package Is Downloaded and Executed at Runtime

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:68-90
Additional Locations: SKILL.md:105-108,128,408; references/cli-commands.md:10,41,77,122,156-168,187; references/token-setup.md:34,46,91,126
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

npx daxiapi-cli@latest config get token

bash

npx daxiapi-cli@latest config set token YOUR_TOKEN_FROM_DAXIAPI

bash

npx daxiapi-cli@latest market temp

The same runtime installation pattern is used for other operations:

bash

npx daxiapi-cli@latest market compass
npx daxiapi-cli@latest market style
npx daxiapi-cli@latest market value

Technical Analysis

The Skill repeatedly instructs the Agent to invoke npx daxiapi-cli@latest. Unless an appropriate verified version is already cached, npx can retrieve the current package release and immediately execute it. The @latest selector is mutable, so the effective executable may change after the Skill has been reviewed.

The project does not provide a pinned version, lockfile, integrity hash, vendored implementation, registry restriction, or package-publisher verification procedure. This creates a supply-chain trust boundary outside the audited project. The downloaded CLI also receives or accesses the user's DAXIAPI bearer token, increasing the sensitivity of a dependency compromise.

The network access to DAXIAPI itself is necessary for the declared market-analysis functionality. However, dynamically executing an unpinned package is not the minimum-risk mechanism needed to perform that access.

Attack Path

1. An attacker compromises the npm package publisher, a maintainer account, the package itself, or one of its transitive dependencies.
2. The attacker publishes a malicious version under the release tag selected by @latest.
3. The Agent follows the Skill and runs npx daxiapi-cli@latest.
4. ` ...[truncated 1100 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace every daxiapi-cli@latest reference with a specific, reviewed package version.
2. Use a lockfile and integrity metadata, or vendor an audited client implementation into the Skill.
3. Verify the expected npm publisher, package provenance, registry, and integrity before execution.
4. Require explicit user approval before downloading or executing the CLI for the first time.
5. Prefer a minimal HTTPS client that calls only the documented DAXIAPI endpoint rather than executing a mutable general-purpose package.
6. Run the client in a restricted environment with limited filesystem access and only the required credential.
7. Re-audit the dependency and its transitive dependency tree before upgrading the pinned version.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/token-setup.md:34

Finding

Bearer Token May Be Exposed Through URLs, Command Output, and Plaintext Shell Configuration

Content

View full analysis

Vulnerability Details

File Location: references/token-setup.md:34-63
Additional Locations: references/api-reference.md:108-113; SKILL.md:68,81,408; references/cli-commands.md:156-162
Vulnerability Type: Insecure credential handling and plaintext secret exposure
Risk Level: Medium

Vulnerable Code

The token setup guide recommends persistent CLI storage and verifies it using a command that may return the configured token:

bash

npx daxiapi-cli@latest config set token YOUR_TOKEN_FROM_DAXIAPI

bash

npx daxiapi-cli@latest config get token

It also documents storing the bearer token directly in a shell startup file:

bash

# Temporary setting for the current terminal session
export DAXIAPI_TOKEN=YOUR_TOKEN_FROM_DAXIAPI

# Persistent setting in the shell configuration file
echo 'export DAXIAPI_TOKEN=YOUR_TOKEN_FROM_DAXIAPI' >> ~/.zshrc
source ~/.zshrc

The API reference additionally documents transmission through a URL query parameter:

http

GET /coze/get_market_temp?token=YOUR_TOKEN_FROM_DAXIAPI

Technical Analysis

A bearer token grants access to the API to anyone who obtains it. The documented handling methods can disclose that credential through several channels:

• Query-string credentials may be retained in shell history, HTTP access logs, reverse-proxy logs, monitoring systems, debugging output, and URL records.
• config get token may print the complete credential into terminal output, Agent transcripts, CI logs, or captured command output.
• Appending the token to ~/.zshrc stores it as plaintext in a commonly read and backed-up file.
• Passing the token directly as a command argument may expose it through shell history and, depending on the operating system, process inspection.
• Persistent CLI storage is recommended without documenting the configuration path, encryption status, or required file permissions.

The API refere ...[truncated 1588 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the URL query-parameter authentication example entirely and require the HTTPS Authorization: Bearer header.
2. Replace config get token with a status command that reports only whether a token is configured, or ensure output is masked except for a short non-sensitive suffix.
3. Do not recommend appending secrets directly to ~/.zshrc, .bashrc, or other startup files.
4. Store persistent credentials in an operating-system keychain or dedicated secret manager.
5. If file-based storage is unavoidable, document the exact path, enforce owner-only permissions, and avoid plaintext storage where possible.
6. Avoid passing secrets directly in command-line arguments. Use protected standard input, a keychain integration, or an ephemeral environment variable supplied by a secret manager.
7. Ensure Agent transcripts, command logs, and error messages redact bearer tokens.
8. Support narrowly scoped, short-lived tokens and document immediate revocation and rotation procedures.
9. Warn users to rotate the token if it has appeared in a URL, shell history, transcript, or log.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (34)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description lists trigger phrases such as “市场估值” and “市场情绪”, which are broad terms that can appear in many general finance conversations, not just requests for this specific skill. Although the file includes some non-applicable scenarios, it does not provide negative trigger examples or tighter activation constraints to clearly distinguish when the skill should or should not activate based on user wording alone.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs use of npx daxiapi-cli@latest, which fetches and executes the newest package version at runtime. This creates a supply-chain risk: a compromised publisher account or malicious update could cause arbitrary code execution on the analyst/agent host, and the token-handling context makes the blast radius larger because secrets may be exposed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This command again relies on npx ...@latest, meaning the executed code is not stable or reviewable at skill-authoring time. In a security-sensitive environment, that allows unexpected code changes to run with user privileges and access environment variables such as API tokens.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The token setup flow tells the user to pass a secret into an unpinned package executed via npx. If that package is altered upstream, it could capture or exfiltrate the provided token during configuration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes this skill as analyzing A-share market temperature specifically through four indicators: valuation temperature, fear-greed, trend temperature, and momentum temperature. However, the documented workflow explicitly adds separate capabilities for large-vs-small-cap style rotation and index valuation data retrieval, which are additional analytics domains not stated in the manifest and not obviously required to implement the four-temperature analysis.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The recommended market compass invocation executes an unpinned remote package at runtime. Because this is the primary analysis path, exploitation would be likely during normal skill use and could lead to arbitrary command execution or tampered output.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using npx ...@latest for the core market temp workflow exposes users to the same supply-chain execution risk on every run. Since the skill is designed for repeated invocation, the chance of eventually consuming a malicious update is non-trivial.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The market style command is also executed through an unpinned package, enabling unauthorized code changes to enter through an auxiliary feature path. While not as central as token setup, it still grants code execution under the user's account.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The market value command repeats the same unpinned runtime execution pattern. Even read-only analysis commands are dangerous when the executable itself can change unexpectedly and run arbitrary code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The loop step directs recurring execution of npx daxiapi-cli@latest market temp, compounding supply-chain risk through frequent runs. Repeated scheduled or habitual use increases exposure to malicious package updates and output manipulation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The report requirements mark '大小盘风格' as a mandatory section, even though the manifest only claims analysis via valuation temperature, fear-greed index, trend temperature, and momentum temperature. Making style analysis mandatory indicates the skill actually delivers a broader market-style analysis product than the manifest advertises.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This duplicate occurrence at the same line still reflects a real issue because both config get token and config set token flows depend on unpinned npx execution. The combination of dynamic package retrieval and token entry materially increases the risk of credential compromise.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document gives contradictory guidance by explicitly presenting token transmission via a URL query parameter, then later stating tokens should not be sent in URLs. Query-string tokens are commonly exposed in browser history, server logs, proxies, analytics, referrers, and shared screenshots, so documenting this as a supported method can lead users to adopt an unsafe authentication pattern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The markdown documents an unsafe token-in-URL authentication method without an immediate warning at the point of use, which normalizes insecure handling of secrets. In this skill context, the API token grants access to market data and may be copied into scripts, logs, or monitoring tools, increasing the chance of credential leakage and unauthorized API use.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The documentation repeatedly instructs users to run npx daxiapi-cli@latest, which fetches and executes the newest package version at runtime rather than a fixed, reviewed release. If the npm package is compromised, hijacked, or a malicious update is published, users following these instructions could execute attacker-controlled code on their machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

This command uses npx daxiapi-cli@latest, causing users to execute whatever version is currently published to npm. In a supply-chain compromise scenario, a malicious release could run arbitrary code, and this skill's finance-oriented context may encourage users to trust and execute the command quickly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

Using npx ...@latest in docs is a real supply-chain risk because the referenced code is not version-locked and can change after publication of the documentation. An attacker controlling the package or release pipeline could deliver a malicious version to every user invoking the command.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The example directs users to execute a network-fetched npm package at its latest version, which introduces avoidable remote code execution risk via package compromise or typo/hijack scenarios. Even though the command is for market data, it still runs with the user's local privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

The token inspection command still references npx daxiapi-cli@latest, so users may invoke an unreviewed current package while handling authentication material. A malicious published version could exfiltrate tokens or alter local configuration.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This is more serious than the read-only examples because it combines npx ...@latest with a token-setting command. A compromised package version could capture the provided API token during configuration and use it for unauthorized API access or broader account abuse.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Using npx daxiapi-cli@latest market --help still executes code from the latest published package, so even a seemingly harmless help command can trigger malicious install or postinstall behavior. The danger comes from runtime retrieval and execution, not the business purpose of the command.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The best-practice section explicitly recommends npx daxiapi-cli@latest, amplifying the unsafe pattern across the whole skill. Because this is normative guidance rather than a one-off example, it increases the likelihood that users will repeatedly execute unpinned code from the registry.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This document gives concrete market-timing, buy/sell, stop-loss, and position-management guidance in a way that can be acted on directly before the later disclaimer tempers it. In a financial-analysis skill, that creates a real safety/compliance risk because users may treat the content as actionable personalized advice despite the indicators being broad heuristics and not suitability-aware.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.