AKQuant A-Share Backtesting

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:38 AM UTC
• Version: 1.0.1

Overview

This stock-backtesting skill is related to its stated purpose, but it should be reviewed because it ships apparent private portfolio data and uses an unsafe hardcoded import path.

Review before installing. Ask the publisher to remove the apparent real holdings file, replace the hardcoded import path with a package-relative import, and provide pinned dependency installation instructions. Expect the skill to contact AKShare or related third-party data services when fetching market data.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/run_backtest.py:7

Finding

External Import Path Allows Local Module Substitution

Content

View full analysis

Vulnerability Details

File Location: scripts/run_backtest.py, lines 7-9
Vulnerability Type: T07: Tool Hijacking and Spoofing
Risk Level: High

python

import sys
sys.path.insert(0, '/root/.openclaw/workspace/skills/akquant-backtest/scripts')
from double_ma_strategy import run_double_ma_backtest

Technical Analysis

The launcher prepends a hardcoded external workspace directory to Python's module search path. Consequently, double_ma_strategy is loaded from that external directory before Python considers the module bundled with the audited project.

The security properties of the launcher therefore depend on a file outside the reviewed package. If another user, process, previously installed Skill, or compromised component can modify /root/.openclaw/workspace/skills/akquant-backtest/scripts/double_ma_strategy.py, it can replace the expected implementation. Python also executes top-level statements during module import, so malicious code does not need to wait for run_double_ma_backtest to be called.

Attack Path

1. An attacker or compromised local component obtains write access to the hardcoded external scripts directory.
2. The attacker creates or modifies double_ma_strategy.py in that directory.
3. A user follows the documented instructions and runs python3 scripts/run_backtest.py.
4. The launcher places the external directory at index zero of sys.path.
5. Python imports and executes the substituted module instead of the audited project module.
6. The malicious module executes with the same operating-system privileges and environment access as the user running the backtest.

Impact Assessment

Successful exploitation provides arbitrary Python execution in the context of the invoking user. The substituted module could read or alter files accessible to that user, access process environment variables, make network requests, falsify backtest results, or invoke operating-system fu ...[truncated 259 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the hardcoded sys.path.insert operation.
• Package the scripts as a Python module and use an explicit package-relative import, such as from .double_ma_strategy import run_double_ma_backtest.
• If direct script execution must remain supported, derive the trusted bundled directory from Path(__file__).resolve().parent rather than referencing an external workspace.
• Avoid importing modules from directories writable by unrelated users or components.
• Add an integration test that verifies the imported module's resolved path remains inside the installed Skill package.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:195

Finding

Unpinned Third-Party Dependencies Create Supply-Chain Exposure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 195-199
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

bash

source /root/.openclaw/venv/bin/activate
pip install akquant akshare pandas numpy

The same unsafe installation pattern also appears in README.md, lines 37-41.

Technical Analysis

The setup instructions install four packages without exact versions, artifact hashes, a lockfile, or a reviewed package index. Each installation can therefore resolve to a different package release over time. Python packages may execute build backend or installation logic during installation and arbitrary code when subsequently imported.

This is a supply-chain weakness rather than evidence that any named dependency is currently malicious. The risk arises because the effective code installed and executed is mutable after the Skill has been reviewed.

Attack Path

1. A dependency account, package release, build pipeline, package index, or distribution artifact is compromised.
2. A malicious or otherwise unsafe release becomes the version selected by pip.
3. A user follows the documented setup command.
4. Pip downloads and installs the mutable dependency release.
5. Malicious code runs during installation or when the backtesting scripts import the affected package.

Impact Assessment

A compromised dependency could obtain code execution with the privileges of the user running pip or the backtest. It could access files, environment variables, market data, or other resources available to that account.

The dependency command shown does not request root privileges and does not by itself establish persistence. The scope is therefore the activated environment and the invoking user's existing permissions.

Remediation

View remediation

Remediation Suggestions

• Create a reviewed dependency lockfile containing exact versions.
• Require cryptographic hashes for all downloaded artifacts, for example with pip install --require-hashes -r requirements.txt.
• Use a trusted, explicitly configured package index.
• Perform dependency vulnerability and provenance scanning in CI.
• Review updates before regenerating the lockfile.
• Build and install dependencies in an isolated, least-privileged virtual environment.
• Keep installation instructions in README.md and SKILL.md synchronized with the secured lockfile workflow.

T09 · Insecure Skill Coding Practices

Warning

• Location: config/holdings.yaml:4

Finding

Private Portfolio Information Is Distributed in Plaintext Configuration

Content

View full analysis

Vulnerability Details

File Location: config/holdings.yaml, lines 4-29
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

yaml

holdings:
  - stock_code: "601658"
    stock_name: "邮储银行"
    quantity: 25000
    cost_price: 5.444
    current_price: 5.060
    profit_loss: -9593.76
    profit_rate: -0.0705
    
  - stock_code: "600919"
    stock_name: "江苏银行"
    quantity: 3000
    cost_price: 7.373
    current_price: 10.660
    profit_loss: 9859.76
    profit_rate: 0.4457
    
  - stock_code: "603711"
    stock_name: "香飘飘"
    quantity: 2000
    cost_price: 6.226
    current_price: 13.070
    profit_loss: 13688.79
    profit_rate: 1.0994

Technical Analysis

The packaged configuration contains detailed portfolio positions, including security identifiers, quantities, cost bases, current prices, and gains or losses. The file header attributes the configuration to an individual and states that the data originated from OCR processing of a holdings screenshot.

These records are unrelated to the implemented double-moving-average launcher and are stored without access controls or encryption. Anyone who receives or can inspect the Skill package can read them directly.

Attack Path

1. The project or packaged Skill is published, uploaded, shared, backed up, or copied to another system.
2. A recipient opens config/holdings.yaml.
3. The recipient obtains the disclosed portfolio composition and performance information without needing to bypass authentication or encryption.

Impact Assessment

Exploitation causes confidentiality loss involving private financial information. It reveals investment choices, position sizes, acquisition costs, and gains or losses.

This issue does not provide code execution or additional system privileges. Its scope is the sensitive information embedded in the distributed artifact and any inferences that can b ...[truncated 29 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the real portfolio configuration from the repository and all distributed Skill artifacts.
• Replace it with clearly synthetic example data containing no relationship to an actual individual.
• Store user-specific holdings outside the package in a user-controlled configuration directory.
• Add the real configuration path to .gitignore and package exclusion rules.
• If portfolio data must be persisted, apply restrictive file permissions and encryption appropriate to the deployment environment.
• Review repository history and previously published artifacts, because deleting the current file does not remove older copies.
• Establish a pre-commit or CI secret-and-sensitive-data scanning policy covering financial and personal records.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code is broadly aligned with the declared domain of A-share strategy backtesting and does use AKShare data plus AKQuant SMA indicators. However, the declared description materially overstates supported capabilities: this chunk only implements a single double-MA strategy for one stock, with fixed simple buy/sell logic. There is no RSI strategy, no custom strategy support, and no optimization functionality. Thus the description does not accurately represent the full set of capabilities actually present in this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The description promises an A-share backtesting skill built on AKQuant and AKShare with multiple strategy types and optimization. The supplied code is much narrower: it is a Python-only experimental/test module for one specific trend-filtered moving-average strategy using internally generated mock price series. While it is related to trading strategy backtesting in a broad sense, the implementation materially differs from the declared purpose in data source, engine/technology stack, supported strategies, and scope. Therefore the description does not accurately represent the actual code behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description says to use the skill when the user asks to "analyze stock performance," which is broad natural language that could overlap with many generic finance-analysis requests rather than clearly signaling backtesting. The trigger list mixes precise requests with this vague phrase and does not provide exclusion conditions or negative examples to constrain activation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This Python file contains user-facing docstrings and printed output entirely in Chinese, such as the module description and runtime messages. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language selection or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring presents the skill description only in Chinese, which can impose a language requirement without user opt-in. The policy requires avoiding forced language/locale constraints unless the skill offers a choice or clearly documents a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file presents core usage context and examples using Chinese company names and sector labels while the surrounding documentation is in English. This creates an implicit locale/language constraint without explicit user opt-in or a documented justification, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The examples encourage fetching external market data over the network without prominently warning users that running the skill may initiate outbound requests to third-party data sources. In environments with strict egress controls, privacy requirements, or untrusted networks, implicit network access can violate policy and expose metadata such as query timing, requested symbols, or system IP information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The file’s human-readable comments are entirely in Chinese, including the title and metadata descriptions, with no indication that the skill is region-specific or that users can choose another language. This can violate a language/locale policy when a skill imposes a single language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file is entirely presented in Chinese, and there is no indication that users may choose another language or that the locale restriction is intentional. Under the policy criteria, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The test docstring and assertion state that in a sideways market the strategy should stay out or take very few trades, but the later reported result says there were 2 trades and -8.76% return while still marking the test as passed. This is an intent/documentation contradiction within the file rather than an implementation detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file contains user-facing instructional content exclusively in Chinese, which can violate a language/locale policy when no user opt-in or alternative language option is provided. The content does not indicate that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code file executes a backtest when run, but provides no confirmation prompt, print/log message, or inline comment/docstring near the execution path explaining that the script will immediately process the supplied symbol and date range. For code files, user-visible disclosure is expected for operations performed automatically, and this entry point is silent about the action.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This Python file contains user-facing natural-language descriptions and console output entirely in Chinese, starting with the module docstring and continuing through the tests. Under the policy rule for language/locale constraints, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.