Security audit

虾皮SQL自由选股

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stock-screening purpose, but it should be reviewed because it runs an unpinned external CLI with an API token and uses unsafe command templates for user-supplied SQL conditions.

Install only if you trust the Daxi API CLI publisher and are comfortable giving that CLI an API token. Prefer a pinned CLI version, a narrowly scoped revocable token, and a sandboxed/minimal environment; do not pass untrusted free-form SQL conditions through a shell command.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:51
Finding: Unpinned Third-Party CLI Download and Execution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:153
Finding: User-Controlled Query Interpolated into a Shell Command
Content: View full analysis
"` - Check data completeness - Handle exceptional conditions ``` ### Technical Analysis The Skill directs the agent to substitute a user-defined SQL condition into a double-quoted shell command. It does not require grammar validation, shell-safe escaping, or process execution through a structured argument array. SQL conditions can legitimately contain quoted strings. If an implementation performs direct textual substitution and invokes the result through a shell, an attacker may provide a condition containing a closing double quote followed by shell syntax. The shell may then interpret the additional text as a separate command rather than as part of the CLI argument. For example, a malicious condition could be constructed conceptually as: ```text date='2026-06-17'" ; ATTACKER_COMMAND ; echo " ``` After unsafe interpolation, the shell could parse `ATTACKER_COMMAND` separately. The exact payload depends on the operating system and shell. The issue is conditional on an agent or implementation following the documented template through a shell; structured subprocess execution would prevent this attack class. ### Attack Path 1. An attacker submits a stock-screening request containing a crafted condition with quote termination and shell metacharacters. 2. The agent accepts the condition as user-defined SQL input. 3. The implementation replaces `` in the documented command template without strict validation or shell escaping. 4. The resulting command is passed to a command shell. 5. The shell terminates the intended quoted argument and interprets the injected text as shell syntax. 6. The injected command executes with the same privileges as the agent process. ### Impact Assessment Succ ...[truncated 538 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Generic trigger phrases like 股票筛选, 技术筛选, 量化筛选, and 自定义筛选 are likely to overlap with benign, high-level market questions and can cause this skill to capture requests better handled by safer or simpler skills. In this skill's context, unintended activation is more dangerous because the workflow immediately promotes command execution and credential setup for an external CLI, expanding the blast radius of a simple routing mistake.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Generic trigger phrases like 股票筛选, 技术筛选, 量化筛选, and 自定义筛选 are likely to overlap with benign, high-level market questions and can cause this skill to capture requests better handled by safer or simpler skills. In this skill's context, unintended activation is more dangerous because the workflow immediately promotes command execution and credential setup for an external CLI, expanding the blast radius of a simple routing mistake.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing natural language exclusively in Chinese, and there is no indication that the skill is region-specific or that users may opt into this language. Per the policy, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The entire document is written in Chinese, including headings and instructions, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, language constraints should either be optional for the user or explicitly documented as a justified regional limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file contains user-facing instructional content exclusively in Chinese, starting with the title and continuing throughout the document. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale policy issue when no alternative or justification is provided.
Content: No source excerpt is available for this finding.