stock-industry-analyzer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:00 AM UTC
• Version: 1.0.0

Overview

This stock-analysis skill needs review because it claims to use live financial data but can generate and store fabricated or random market data with trading-style suggestions.

Treat this as a demo or research tool unless it is fixed to use verified live data and clearly label data provenance. Do not rely on its reports for trading decisions, review or disable long-term local storage if report history matters, avoid cron automation until outputs are trustworthy, and install only in an isolated virtual environment with reviewed dependency versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: src/analyzer.py:212

Finding

Fabricated and Randomized Financial Data Presented as Real-Time Analysis

Content

View full analysis

List[Dict]: """获取实时新闻（使用真实财经网站URL）""" news_list = [] news_templates = [ {"title": "宁德时代发布新一代电池技术，续航突破1000公里", "industry": "新能源", "companies": ["宁德时代"], "url": "https://finance.eastmoney.com/a/20260313.html"}, {"title": "比亚迪新能源汽车销量突破500万辆", "industry": "新能源", "companies": ["比亚迪"], "url": "https://finance.eastmoney.com/a/20260312.html"}, {"title": "科大讯飞星火认知大模型V4.0发布", "industry": "信息技术", "companies": ["科大讯飞"], "url": "https://finance.eastmoney.com/a/20260311.html"}, {"title": "中国平安发布2024年度业绩报告", "industry": "金融", "companies": ["中国平安"], "url": "https://finance.eastmoney.com/a/20260310.html"}, {"title": "恒瑞医药创新药获批上市", "industry": "医药", "companies": ["恒瑞医药"], "url": "https://finance.eastmoney.com/a/20260309.html"}, {"title": "中芯国际晶圆产能持续扩张", "industry": "半导体", "companies": ["中芯国际"], "url": "https://finance.eastmoney.com/a/20260308.html"}, {"title": "招商银行零售业务增长强劲", "industry": "金融", "companies": ["招商银行"], "url": "https://finance.eastmoney.com/a/20260307.html"}, {"title": "贵州茅台提价预期升温", "industry": "消费", "companies": ["贵州茅台"], "url": "https://finance.eastmoney.com/a/20260306.html"}, ] for i, template in enumerate(news_templates): companies = [] for c in template["companies"]: if c in self.companies: companies.append(self.companies[c]) sentiment, score = self._analyze_sentiment(template["title"]) news_list.append({ "title": templa ...[truncated 5147 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/db.py:142

Finding

SQL Injection Through Unparameterized Time-Window Values

Content

View full analysis

datetime('now', '-{} hours') ORDER BY created_at DESC '''.format(hours), (industry,)) columns = [desc[0] for desc in cursor.description] return [dict(zip(columns, row)) for row in cursor.fetchall()] def get_industry_trend(self, hours=24): """获取行业热度趋势""" cursor = self.conn.cursor() cursor.execute(''' SELECT industry, COUNT(*) as news_count, SUM(CASE WHEN sentiment = '利好' THEN 1 ELSE 0 END) as positive, SUM(CASE WHEN sentiment = '利空' THEN 1 ELSE 0 END) as negative, AVG(sentiment_score) as sentiment FROM news WHERE created_at > datetime('now', '-{} hours') GROUP BY industry ORDER BY news_count DESC '''.format(hours)) columns = [desc[0] for desc in cursor.description] return [dict(zip(columns, row)) for row in cursor.fetchall()] ``` ### Technical Analysis Parameter binding is correctly used for `industry`, but not for `hours`. Python string formatting inserts the value into the SQL statement before SQLite parses it. A crafted value can terminate the SQLite date modifier and append an alternative predicate. For example, a value conceptually shaped like: ```text 1 hour') OR 1=1 -- ``` can transform the first query into a predicate equivalent to: ```sql WHERE industry = ? AND created_at > datetime('now', '-1 hour') OR 1=1 -- hours') ``` Operator precedence causes the appended `OR 1=1` condition to bypass the intended industry and time restrictio ...[truncated 1652 chars]

Remediation

View remediation

datetime('now', ?) ORDER BY created_at DESC """, (industry, f"-{hours} hours"), ) columns = [desc[0] for desc in cursor.description] return [dict(zip(columns, row)) for row in cursor.fetchall()] def get_industry_trend(self, hours=24): hours = _validate_hours(hours) cursor = self.conn.cursor() cursor.execute( """ SELECT industry, COUNT(*) AS news_count, SUM(CASE WHEN sentiment = '利好' THEN 1 ELSE 0 END) AS positive, SUM(CASE WHEN sentiment = '利空' THEN 1 ELSE 0 END) AS negative, AVG(sentiment_score) AS sentiment FROM news WHERE created_at > datetime('now', ?) GROUP BY industry ORDER BY news_count DESC """, (f"-{hours} hours",), ) columns = [desc[0] for desc in cursor.description] return [dict(zip(columns, row)) for row in cursor.fetchall()] ``` Additional hardening: 1. Enforce integer types at all API and command-line boundaries. 2. Apply minimum and maximum limits to reporting windows. 3. Never use string interpolation for SQL values. 4. Add tests using quotes, comments, parentheses, and boolean expressions as malicious input. 5. Restrict access to the SQLite database file using appropriate filesystem permissions. ]]>

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded Third-Party Dependency Resolution

Content

View full analysis

=1.12.0 pandas>=1.5.0 jieba>=0.42.0 yfinance>=0.2.0 ``` The documented installation process executes: ```bash pip install -r requirements.txt ``` ### Technical Analysis Each `>=` constraint permits pip to install any later release satisfying the minimum version, including releases that did not exist when the Skill was reviewed. Transitive dependencies are also unconstrained, and the project provides no lock file, package hashes, or package-index restrictions. Installing Python packages may execute package build backends and installation hooks. At runtime, imported dependencies execute with the same privileges as the Skill process. Consequently, a future compromised release or compromised transitive dependency could affect the installation or runtime environment without any change to this repository. No typo-squatted package name, custom package index, direct URL dependency, or dependency known from the reviewed evidence to be malicious was found. This finding therefore concerns unsafe dependency management rather than a confirmed malicious package. The repository also lists dependencies that are not used by the inspected production implementation, increasing the supply-chain surface without a demonstrated functional requirement. ### Attack Path 1. A user follows the documentation and runs `pip install -r requirements.txt`. 2. pip queries its configured package index and selects the newest releases satisfying the minimum constraints. 3. A future compromised, malicious, or incompatible direct or transitive release is selected. 4. Package build or installation code executes with the privileges of the installing user. 5. The installed package later executes again when imported by the Skill. 6. ...[truncated 1010 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (28)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring explicitly claims support for AkShare, yfinance, NewsAPI, and 'real news', but the implementation only returns hard-coded and mock entries. In a financial-analysis skill, this is dangerous because downstream agents or users may rely on fabricated market news as if it were live external data, enabling misinformation, bad decisions, and integrity loss.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The function _fetch_realtime_news is presented as retrieving real-time news from real financial URLs, but it constructs predefined articles with current timestamps and randomized sources. This makes fabricated content appear fresh and authentic, which is especially risky in a stock/industry analysis context where timeliness and provenance directly affect trust and decision-making.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly documents persistent local storage and long retention periods for reports and logs, but provides no privacy notice, data-minimization guidance, or retention controls. In a tool that ingests external news and generates archived reports, this can lead to unnecessary accumulation of potentially sensitive operational data and make local compromise or misuse more damaging over time.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill states that it should automatically trigger whenever a user requests stock or industry analysis, which is a broad and common class of requests. In an agent environment, this can cause unintended activation, leading the agent to invoke external-data workflows or produce financial-analysis outputs when the user did not explicitly consent to using this specific skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file contains natural-language comments and explicit stdout/stderr UTF-8 handling paired with a Chinese-language skill description and logs, indicating the skill is oriented toward a specific language/locale without offering any user opt-in or configuration. Under the policy rule, forcing a specific language or locale without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The docstring at L100 says the method runs only once and does not store data, but the class constructor at L25-L27 always initializes a database connection and writes a log entry at L27 via L32. This is an active contradiction between the documented intent of a non-storing mode and the actual side effect of persisting log data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script saves a generated report to a fixed path using a file write operation. Although it logs the save after the fact, there is no confirmation prompt, advance disclosure in comments/docstring, or other user-facing warning before modifying the filesystem.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The function presents itself as using real market data but silently falls back to simulated prices, indicators, and scores when AkShare fails. In a stock-analysis skill, fabricated outputs can mislead downstream users into making financial decisions based on false data, especially because the simulated fallback is not clearly surfaced as an error condition.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code produces concrete investment-style recommendations such as buy, watch, or avoid without prominently warning that the analysis may be simulated and is not financial advice. In this skill context, that increases the chance users treat heuristic or fabricated outputs as trustworthy trading guidance, causing financial harm.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains user-facing natural language in Chinese in the module docstring, method docstrings, and generated content, but it does not provide any opt-in or alternative language handling. Under the policy, forcing a specific language without user choice can be a locale-policy violation unless the regional scope is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module description and all generated report text are written exclusively in Chinese, indicating the skill is designed to produce Chinese-language output by default. For a general-purpose reporting skill, this is a locale/language policy concern unless the user is given a language choice or the region-specific constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The README content, including feature descriptions, usage guidance, and cautions, is written in Chinese, which effectively forces a specific language for users of the skill. There is no indication that the skill offers localization options or that the Chinese-only presentation is an intentional, documented region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 70% confidence

Finding

The natural-language instructions and usage are entirely presented in Chinese, and the skill references Chinese-specific processing such as 'jieba (中文分词)' without stating that the skill is intentionally limited to Chinese-language users or data. Under the policy, a locale constraint should either be optional for the user or explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This manifest contains user-facing natural-language values in multiple languages, with several retention settings expressed only in Chinese (e.g. '永久') while other entries are English-language source names. Because the file does not document a required locale or offer an explicit language choice, it may impose a locale assumption that violates the language/locale policy guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This plain-text report is entirely presented in Chinese, including headings, analysis, recommendations, and the risk notice, with no indication that the user opted into that locale or that the skill is intended only for a Chinese-speaking or region-specific audience. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This plain-text report presents all headings, analysis, and recommendations exclusively in Chinese. Under the natural-language policy rules, forcing a specific language without user opt-in can be a locale-policy violation when no choice or justification is provided.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a lower bound only, which permits installation of any newer release, including versions with breaking changes or newly introduced malicious or vulnerable code. This weakens build reproducibility and increases supply-chain risk because different environments may resolve to different package versions over time.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

akshare>=1.12.0
pandas>=1.5.0
jieba>=0.42.0
yfinance>=0.2.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Using pandas with only a minimum version allows dependency resolution to select unreviewed future releases, reducing reproducibility and making it harder to ensure a safe version is consistently installed. In a supply-chain compromise or accidental regression scenario, this can expose consumers to vulnerable or malicious package versions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

akshare>=1.12.0
pandas>=1.5.0
jieba>=0.42.0
yfinance>=0.2.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 77% confidence

Finding

The manifest does not pin pandas, and there is at least one known advisory affecting some pandas versions, so it is impossible to determine from this file alone whether an affected release may be installed. The cited CVE is disputed and context-dependent, which lowers severity, but the lack of version pinning still leaves uncertainty around exposure.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The jieba requirement is not pinned to a specific version, so installations may vary across time and environments. This creates a supply-chain and reproducibility weakness because a later package release could introduce vulnerabilities or unexpected behavior.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

akshare>=1.12.0
pandas>=1.5.0
jieba>=0.42.0
yfinance>=0.2.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Specifying yfinance as >=0.2.0 permits any future release to be installed, which undermines deterministic builds and increases exposure to upstream security or integrity issues. While not directly exploitable on its own, it is a recognized dependency hygiene weakness.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

akshare>=1.12.0
pandas>=1.5.0
jieba>=0.42.0
yfinance>=0.2.0

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The natural-language comments are written only in Chinese, which imposes a specific language context without offering user choice or documenting a justified locale restriction. Under the policy, language constraints should be opt-in or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The code writes to a fixed report path and overwrites the file contents, but there is no prior confirmation prompt or explanatory warning before the write occurs. Although a success message is printed afterward, that does not disclose the write operation in advance or warn that an existing report may be replaced.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

Several inline comments are written only in Chinese, which imposes a language choice on maintainers or users reading the skill file. There is no indication that the skill is intentionally region-specific or that an alternative language is offered.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The module docstring names the skill only in Chinese ("股票行业分析 Skill"), which indicates a language-specific presentation without any visible option for user language choice. The policy requires flagging language or locale constraints when they are imposed without opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.