Eastmoney Select Stock 1.0.2

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:22 AM UTC
• Version: 1.0.0

Overview

The skill appears to do stock screening as advertised, but it needs Review because its setup tells users to print an API key and its CSV export writes remote data without spreadsheet-safety handling.

Install only if you are comfortable sending stock-screening queries and your Eastmoney API key to the documented Eastmoney endpoint. Do not follow the `echo $EASTMONEY_APIKEY` instruction; check only whether the variable is set. Treat generated CSV files as untrusted provider data and open them in a viewer that will not evaluate spreadsheet formulas unless the export is sanitized first.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:17

Finding

API Key Disclosed Through Terminal Output

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/stock_screen.py:86

Finding

Spreadsheet Formula Injection in CSV Export

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented purpose does not fully match the implemented behavior: the example code performs external API calls using an API key and writes a CSV file locally, while those operational behaviors are not clearly declared as capabilities in the skill contract. This mismatch can mislead reviewers and users about data flow and side effects, which is a security concern because hidden egress and local persistence reduce informed consent and oversight.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill uses sensitive capabilities—environment variable access, outbound network requests, and local file writes—but does not declare any tool scope or permission boundaries. This increases the risk of overbroad execution in hosts that rely on manifest-declared permissions, making it harder to audit what data can leave the system or what local artifacts can be created.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

2. 使用POST请求调用接口：

   bash

   curl -X POST --location 'https://mkapi2.dfcfs.com/finskillshub/api/claw/stock-screen' \
   --header 'Content-Type: application/json' \
   --header "apikey: $EASTMONEY_APIKEY" \
   --data '{"keyword": "选股条件", "pageNo": 1, "pageSize": 20}'
   

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script's natural-language interface, usage instructions, errors, and output are presented only in Chinese, which imposes a specific language on users without opt-in or alternative locale support. This matches the policy category for language or locale restrictions because no user-selectable language option or justification is provided in the file.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md

}
    
    try:
        response = requests.post(url, headers=headers, json=data)
        response.raise_for_status()
        result = response.json()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/stock_screen.py (reported line 43)May include surrounding context.

python

}
    
    try:
        response = requests.post(url, headers=headers, json=data)
        response.raise_for_status()
        result = response.json()

Tainted flow: 'headers' from requests.post (line 81, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/stock_screen.py (reported line 43)May include surrounding context.

python

}
    
    try:
        response = requests.post(url, headers=headers, json=data)
        response.raise_for_status()
        result = response.json()

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes the skill as supporting stock screening, querying sector constituents, and recommendation-related tasks, which reads as a data retrieval/analysis capability. This script also persists full query results to a local CSV file, adding a file-write/export behavior not reflected in the stated description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest focuses on stock selection and related market queries, but the implementation also depends on reading a secret from the process environment. While common operationally, credential access is not part of the described end-user capability and is not justified by the manifest text itself.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.