技术分析-缠论

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:00 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate stock-analysis skill, but it under-discloses credential handling and an automatic Yahoo Finance fallback.

Review this before installing. Use a restricted virtual environment, avoid putting TUSHARE_TOKEN in ~/.bashrc, do not expose the token during install, and expect possible requests to both Tushare and Yahoo Finance unless the fallback is removed or explicitly controlled.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/chanlun_core.py:402

Finding

Automatic Use of an Undeclared Dependency and External Network Service

Content

View full analysis

Vulnerability Details

File Location: scripts/chanlun_core.py:402-414
Vulnerability Type: Undeclared runtime dependency and external service
Risk Level: Medium

Vulnerable Code

python

if not use_tushare or df is None or len(df) == 0:
    # 备用：使用 Yahoo Finance
    import yfinance as yf

    if period == 'daily':
        df = yf.download(ts_code, period='3mo', progress=False)
    else:
        df = yf.download(ts_code, period='1mo', interval=period, progress=False)

The corresponding metadata only declares Tushare:

json

"dependencies": {
  "pip": [
    "pandas>=1.5.0",
    "numpy>=1.20.0",
    "matplotlib>=3.5.0",
    "tushare>=1.2.0"
  ]
},
"sideEffects": {
  "readsFiles": true,
  "writesFiles": true,
  "networkAccess": true,
  "externalServices": ["Tushare API"]
}

Technical Analysis

The application automatically imports yfinance and sends requests to Yahoo Finance whenever Tushare is disabled, fails, or returns no records. However, yfinance is absent from the declared package dependencies, and Yahoo Finance is absent from the declared external services.

This discrepancy prevents users and deployment systems from accurately determining the software and network resources used by the skill. It can also cause an availability failure if yfinance is not already installed. If an unexpected or compromised yfinance package is present in the environment, its module-level code executes at import time with the privileges of the skill process.

The fallback is automatic after a broad Tushare exception rather than being subject to explicit user approval. The requested stock identifier and associated request metadata may consequently be disclosed to a second provider that is not identified in the skill manifest.

Attack Path

1. The user invokes the skill to analyze a stock.
2. The Tushare request fails, returns no data, or Tushare use is disabled.
3. The fallback branch imports the undeclared yfinance package.
4. Any m ...[truncated 1058 chars]

Remediation

View remediation

Remediation Suggestions

1. Add an exact, reviewed yfinance version to the declared dependencies.
2. Add Yahoo Finance to sideEffects.externalServices.
3. Document what information is sent to each provider.
4. Require explicit provider selection or user approval before switching from Tushare to Yahoo Finance.
5. Catch narrowly defined network and API exceptions instead of using a broad except Exception to trigger fallback behavior.
6. Fail closed with a clear error if the selected provider is unavailable unless the user has explicitly enabled fallback.
7. Use a lockfile and package hashes so an unexpected package cannot satisfy the undeclared import.
8. Run the skill with restricted filesystem access, a minimal environment, and network access limited to approved provider domains.

T08 · Insecure Dependencies

Warning

• Location: skill.json:27

Finding

Mutable and Unverified Third-Party Dependency Resolution

Content

View full analysis

Vulnerability Details

File Location: skill.json:27-33
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

json

"dependencies": {
  "pip": [
    "pandas>=1.5.0",
    "numpy>=1.20.0",
    "matplotlib>=3.5.0",
    "tushare>=1.2.0"
  ]
}

The documentation also recommends installation without version or integrity constraints:

bash

pip install pandas numpy matplotlib tushare

Technical Analysis

The dependency declarations use unrestricted lower bounds, while the documented installation command does not specify versions at all. No reviewed lockfile or cryptographic package hashes are provided.

As a result, the effective code executed by the skill can change over time without any modification to the audited project. Future package versions may be incompatible or contain compromised code. Python packages can execute code during installation and whenever imported, so dependency integrity is part of the skill's effective security boundary.

This is a supply-chain weakness rather than evidence that any currently named dependency is malicious. Exploitation depends on compromise of a package release, package distribution account, package index, or dependency-resolution environment.

Attack Path

1. A user or automated deployment follows the documented pip install command or resolves the lower-bound requirements.
2. The package installer selects the newest releases satisfying the broad constraints.
3. A compromised or otherwise unsafe future release is downloaded because no exact version or hash is enforced.
4. Package installation hooks or imported module code execute with the privileges of the installer or skill process.
5. The dependency can access resources available to that process, including local files, environment variables, and permitted network destinations.

Impact Assessment

The vulnerable project code does not directly grant elevated privileges. The potential scope is det ...[truncated 659 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a requirements or lock file containing exact, reviewed dependency versions.
2. Record cryptographic hashes for every direct and transitive package.
3. Install with hash enforcement, for example:

bash

python3 -m pip install --require-hashes -r requirements.txt

4. Add the actually used yfinance package to the locked dependency set.
5. Regenerate the lockfile through a controlled review process rather than automatically accepting the newest releases.
6. Use a private or explicitly trusted package index and disable unintended extra indexes.
7. Run dependency vulnerability and provenance checks in CI.
8. Install and execute the skill in an isolated, unprivileged virtual environment or container.
9. Keep sensitive environment variables out of package installation processes and expose TUSHARE_TOKEN only to the runtime process that requires it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

| 手机号注册 → 实名认证 → 获取 Token | | 免费额度 | 新用户赠送 500 积分，基础日线数据免费 | | 积分说明 | 积分越高，接口权限越多，详细权限见官网 |

环境变量配置

方式一：临时配置（当前终端有效）

bash

export TUSHARE_TOKEN=your_token_here

方式二：永久配置（写入 ~/.bashrc）

bash

echo 'export TUSHARE_TOKEN=your_token_here' >> ~/.bashrc
source ~/.bashrc

验证配置

bash

python3 -c "import os; print('TUSHARE_TOKEN:', os.getenv('TUSHARE_TOKEN', 'NOT SET'))"

常见问题

问题	解决方案
Token 未设置	报错 TUSHARE_TOKEN environment variable is required
Token 无效	检查 Token 是否正确复制，无多余空格
接口权限不足	登录 Tushare 官网查看积分权限

必需环境变量

变量名	说明	必需	获取方式
TUSHARE_TOKEN	T

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation instructs users to persist an API token by appending it directly to ~/.bashrc, which stores a secret in plaintext in a broadly reused shell startup file. This increases the chance of accidental disclosure through dotfile syncing, backups, screen sharing, shell history-adjacent troubleshooting, or multi-user/local compromise, even though it is not itself malware.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains natural-language strings, help text, and generated report content entirely in Chinese, including the CLI description and user-facing outputs. Under the policy rule for language/locale, forcing a specific language without opt-in is a violation when no language selection or justification is provided.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The top-level documentation describes the file as "缠论核心算法 - 分型、笔、线段识别", which implies a pure analysis/algorithm module. However, later code adds external data acquisition via Tushare and Yahoo Finance and accesses the TUSHARE_TOKEN environment variable, which materially expands the module's behavior beyond the documented algorithm-only role.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module description is written entirely in Chinese, indicating the skill is tailored to a single language/locale without any visible option for users to choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger list contains broad phrases such as general technical-analysis and trend-judgment terms that are likely to overlap with ordinary user requests. This can cause the skill to activate unexpectedly, leading to unintended network calls and file writes in contexts where the user did not explicitly request this specific stock-analysis tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill requires a TUSHARE_TOKEN environment variable, but the manifest does not clearly communicate to users that execution depends on accessing a sensitive credential. In an agent environment, implicit credential use can surprise users and increase the chance of unintended external service access under their identity or quota.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest declares file writes and network access, but the user-facing description and security fields understate the operational impact by labeling risk as low and requiring no approval. If auto-invoked, the skill could send data to an external API and create local artifacts without sufficiently explicit consent or warning.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation states that PNG output uses English labels, and later reiterates that all chart labels use English. This imposes a specific language choice without offering user opt-in, configuration, or a documented compliance reason, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This line explicitly says all charts use English labels to avoid font dependency issues. Even if technically motivated, the file does not present this as a user choice or clearly frame it as a justified locale limitation in the skill behavior section, so it is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.