ClawHub
Back to skill

Security audit

小果量化因子分析系统助手

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed quantitative factor-analysis skill with broad market-data and local-output behavior, but I did not find artifact-backed deception, credential access, exfiltration, destructive behavior, or persistence.

Install dependencies in an isolated virtual environment and pin versions before serious use. Run xtdata/yfinance data-fetching examples only when you intend to contact those providers, review 因子表.json before batch factor runs, and treat generated trading/factor signals as research outputs rather than investment instructions. Be careful with force-recalculation paths because they can overwrite local factor-output files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:106
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:106
Vulnerability Type: Unpinned package installation from a mutable package index
Risk Level: Medium

Vulnerable Code:

bash
pip install pandas numpy matplotlib seaborn scipy statsmodels alphalens quantstats

Technical Analysis

The installation instruction resolves all dependencies from the package index without version constraints, cryptographic hashes, or a reviewed lockfile. Consequently, the effective code installed by this command can change over time even though the Skill itself remains unchanged.

Python packages may execute package-controlled code during installation and later during import. If a listed package, a transitive dependency, or the package-index delivery path is compromised, executing this instruction could install and run attacker-controlled code. Unintentional breaking or vulnerable dependency updates are also possible.

This is a supply-chain weakness rather than evidence that any currently listed package is malicious.

Attack Path

  1. A user or agent follows the dependency installation instruction in SKILL.md.
  2. pip queries its configured package index and resolves mutable package versions and transitive dependencies.
  3. An attacker compromises a dependency release, maintainer account, package-index path, or dependency name resolution.
  4. pip downloads and installs the attacker-controlled distribution.
  5. Malicious package code runs during installation or when the Skill imports the affected dependency.
  6. The payload executes with the privileges and environmental access of the user running pip or the analysis process.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The resulting scope may include access to project files, factor and market datasets, process environment variables, user-writable files, and network resources available to ...[truncated 333 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a reviewed, exact version.
  2. Resolve and pin all transitive dependencies in a lockfile.
  3. Record cryptographic hashes and install with pip --require-hashes.
  4. Obtain packages only from an explicitly configured, trusted index or an internally controlled artifact repository.
  5. Install dependencies in an isolated virtual environment or container under a non-privileged account.
  6. Avoid running package installation with root or administrator privileges.
  7. Add automated dependency vulnerability, provenance, and license scanning.
  8. Review and update the lockfile through a controlled process rather than resolving unrestricted latest versions at runtime.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (42)

Whitespace Padding

High
Category
Prompt Injection
Confidence
80% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/xg_factor.txt (reported line 2029)May include surrounding context.

text
'''逆势操作 - AL'''
        cdp_val, ah_val, nh_val, nl_val, al_val = CDP_STD(CLOSE=self.C, HIGH=self.H, LOW=self.L)
        return al_val

Ae5

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Instruction-capable artifact exceeds whole-file semantic analysis limits

Content

No source excerpt is available for this finding.

YARA rule 'privilege_escalation_tools': Privilege escalation tools and techniques [hacktools]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · 小果因子分析系统.txt (reported line 769)May include surrounding context.

text
qlixooKDgx1eg7//reu3L126lOrypLmzktYDAAAAAABA5rhUoFWgQAFZLBm7xtTLy0uJiYkOryHp7oZHjx5NdfmxY8eSrQcAAAAAAIDMcalAq0GDBjp27JiOHDmS7noXL15USEiI7rvvPofX0KpVK0nS6tWrUyy7evWqtm3bJnd3dzVt2tThzw0AAAAAAJAfuNQcWkOGDNHff/+tV155RdOmTVP16tVTrHPlyhW99tprMpvNeu211xxew4MPPqiyZctqw4YN+uGHH/Sf//xH0q25s95++21FR0erZ8+eqd4BEQAAuL7s3p7eUfsAAAAwMpcKtDZt2qSHH35YS5YsUadOndSkSRPVrl1bRYsWVXR0tI4ePaoNGzYoNjZWFStW1Jw5c1Lsw2Qy6aOPPspyDR4eHvroo4/Ut29fvfvuu/rpp59Urlw57d69W2FhYapVq5YGDx6cnZcJAAAMyGq1KcFq1byWPRyyvwSrNdt3BQMAADAqlwq0xo0bJ9P/36c3MTFRmzdv1pYtW+zLb7+N66lTp3Tq1Cn71yaTSTabLduBliQ1bNhQCxcu1NSpU7V9+3YdO3ZM5cqVU7du3fT888/Ly8srW/sHAADGY7XadP1qtMxmk8P2R6AFAADyK5cKtDp27GgPtJytevXq+uyzz5xdBgAAyEMIoQAAABzDpQKtDz/80NklAAAAAAAAIIe5VKAFAAAAAAByTnZvTMKNTeAoLhto7dq1Sxs3btTx48cVExMjHx8fVa9eXW3atEn17ocAAAAAACB11pvXlOigm5twYxM4gssFWv/++6+GDx+unTt3Sko+EfzKlSv16aefqkOHDho9erQKFy7srDIBAAAAADCMxOhQWcxmRUTEKDHRmq19MackHMGlAq3IyEg9++yzunDhgsxmsxo0aKDAwEB5eXkpMjJShw4d0u7du/Xbb78pNDRUs2fPlpubS70FAAAAAADkmMREqxISshdoAY7gUmnOrFmzdP78eVWt

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown skill forces a specific language/locale in its natural-language interface and documentation. Under the policy, locale constraints should either be optional or clearly justified; here there is no user opt-in or stated region-specific requirement.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes a factor analysis assistant focused on cleaning data and evaluating factors with Alphalens-style analytics. However, these functions actively subscribe to quotes and fetch market data through xtdata, which is an external data-access capability rather than pure local analysis logic. While useful in some workflows, this capability is not stated in the manifest and is not necessary for the core evaluation functionality itself.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file contains a very large set of technical-indicator and signal-generator methods unrelated to pure factor evaluation, creating a broad capability gap between advertised behavior and actual behavior. This increases the risk of hidden or unintended autonomous trading advice, misuse by other components, and reduced auditability because the skill is far more powerful than its manifest suggests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

Unlike a docstring-only issue, this method named CROSS_DOWN implements the same logic as CROSS_UP, so callers relying on it for inverse behavior will receive the wrong signal. In this skill context, which already exceeds its declared analysis scope and includes many actionable signal functions, incorrect inverse-signal logic can materially misdrive automated screening or trading workflows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This section exposes explicit trading and timing signal outputs (e.g., buy/sell, flat/open-long, flat/open-short) that go beyond the manifest’s stated factor-analysis and Alphalens-style evaluation scope. In an agent-skill setting, scope mismatch is dangerous because downstream users or orchestrators may trust the declared purpose while the code quietly performs decision-driving market-timing behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Natural-language comments, status messages, and user-facing output throughout the file are in Chinese, and the skill does not provide any user opt-in or alternative language handling. This can violate language/locale policy when a skill forces a specific language without offering choice or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The worker parses method names and arguments from JSON-controlled strings and then uses getattr(models, func_name) to invoke any callable attribute on the xg_factor model. If an attacker or untrusted party can influence 因子表.json or the model surface, they can trigger unintended methods, unsafe side effects, denial of service, or execution paths never meant to be exposed through configuration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

In the single-thread staged path, the async/IO branch calls get_stock_data() and then directly writes that DataFrame to 全部因子数据/*.parquet without running factor computation. This silently produces output files that appear to be factor results but actually contain only raw stock data, creating data integrity and downstream decision-risk issues in a quantitative trading context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This branch silently saves raw stock data into the factor output location without warning, causing operators and downstream tools to treat incorrect artifacts as completed factor datasets. In a financial-analysis skill, that can corrupt research, backtests, or trading inputs while remaining hard to detect.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/alphalens/examples/intraday_factor.txt (reported line 367)May include surrounding context.

text
},
   "source": [
    "non_predictive_factor_data = alphalens.utils.get_clean_factor_and_forward_returns(factor, \n",
    "                                                                                  pricing, \n",
    "                                                                                  periods=(1,2),\n",
    "                                                                                  groupby=ticker_sector,\n",
    "                                                                                  groupby_labels=sector_names)"

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/alphalens/examples/intraday_factor.txt (reported line 368)May include surrounding context.

text
},
   "source": [
    "non_predictive_factor_data = alphalens.utils.get_clean_factor_and_forward_returns(factor, \n",
    "                                                                                  pricing, \n",
    "                                                                                  periods=(1,2),\n",
    "                                                                                  groupby=ticker_sector,\n",
    "                                                                                  groupby_labels=sector_names)"

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/alphalens/examples/intraday_factor.txt (reported line 369)May include surrounding context.

text
},
   "source": [
    "non_predictive_factor_data = alphalens.utils.get_clean_factor_and_forward_returns(factor, \n",
    "                                                                                  pricing, \n",
    "                                                                                  periods=(1,2),\n",
    "                                                                                  groupby=ticker_sector,\n",
    "                                                                                  groupby_labels=sector_names)"

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/alphalens/examples/intraday_factor.txt (reported line 370)May include surrounding context.

text
},
   "source": [
    "non_predictive_factor_data = alphalens.utils.get_clean_factor_and_forward_returns(factor, \n",
    "                                                                                  pricing, \n",
    "                                                                                  periods=(1,2),\n",
    "                                                                                  groupby=ticker_sector,\n",
    "                                                                                  groupby_labels=sector_names)"

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/alphalens/examples/overview.txt (reported line 488)May include surrounding context.

text
},
   "source": [
    "quant_return_spread, std_err_spread = alphalens.performance.compute_mean_returns_spread(mean_return_by_q_daily,\n",
    "                                                                                        upper_quant=5,\n",
    "                                                                                        lower_quant=1,\n",
    "                                                                                        std_err=std_err)"
   ],

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/alphalens/examples/overview.txt (reported line 489)May include surrounding context.

text
},
   "source": [
    "quant_return_spread, std_err_spread = alphalens.performance.compute_mean_returns_spread(mean_return_by_q_daily,\n",
    "                                                                                        upper_quant=5,\n",
    "                                                                                        lower_quant=1,\n",
    "                                                                                        std_err=std_err)"
   ],

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/alphalens/examples/overview.txt (reported line 490)May include surrounding context.

text
},
   "source": [
    "quant_return_spread, std_err_spread = alphalens.performance.compute_mean_returns_spread(mean_return_by_q_daily,\n",
    "                                                                                        upper_quant=5,\n",
    "                                                                                        lower_quant=1,\n",
    "                                                                                        std_err=std_err)"
   ],

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/alphalens/examples/overview.txt (reported line 1093)May include surrounding context.

text
},
   "source": [
    "mean_return_quantile_sector, mean_return_quantile_sector_err = alphalens.performance.mean_return_by_quantile(factor_data, \n",
    "                                                                                                             by_group=True)"
   ],
   "outputs": []
  },

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This .txt file contains extensive user-facing narrative text entirely in Chinese, including headings, explanations, ratings, and recommendations. Under the policy rule, forcing a specific language/locale without offering user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The manifest presents the skill as an assistant for factor analysis and scoring, but the code imports xg_data and later creates self.xg_data = xg_data(), introducing a broader data-access capability. Because the documented purpose centers on analytics rather than data-source integration, this expands the operational context beyond what users would infer from the manifest alone.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This plain-text file contains natural-language comments in Chinese, starting at L0021, while the file otherwise uses English identifiers and has no indication that Chinese is required or that users may choose their preferred language. Under the policy rule, forcing or assuming a specific language without opt-in is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

KDJ_KD死叉 computes CROSS(D,K), which is consistent with a death-cross style signal, but its docstring says 'KDJ_KD金叉 的 Docstring'. This is an active contradiction between inline documentation and the implemented intent of the method.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

RSI_死叉 returns CROSS(RSI2, RSI1), indicating the opposite direction from a golden cross, yet the docstring says 'RSI_金叉 的 Docstring'. This directly misstates the method's intent and could mislead downstream users interpreting the signal.

Content

No source excerpt is available for this finding.