ClawHub
Back to skill

Security audit

futures-panda

Security checks for vulnerabilities and agentic risk

Overview

This skill is a user-invoked AKShare futures-data helper with some documentation and dependency-quality issues, but no hidden persistence, credential handling, destructive action, or exfiltration in the inspected artifacts.

Install this only in an isolated Python environment and avoid treating returned market data as investment advice. Expect some documented commands or capabilities to be inaccurate, and prefer pinned, reviewed dependency versions if reproducibility matters.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:9
Finding

Unbounded and Unverified Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-15
Vulnerability Type: Unpinned dependencies without integrity verification
Risk Level: Medium

Vulnerable Code

yaml
      "requires": { "pip": ["akshare>=1.12", "pandas>=1.5"] },
      "install":
        [
          {
            "id": "pip-install",
            "kind": "pip",
            "packages": ["akshare>=1.12", "pandas>=1.5"],

The installation documentation in references/README.md also instructs users to install the latest available releases:

bash
pip install akshare pandas

Technical Analysis

The skill specifies only minimum versions for akshare and pandas, with no exact version lock, upper bound, package hashes, or reviewed lock file. Consequently, the code installed during deployment can differ from the code that was present when the skill was audited.

This does not demonstrate that either named package is currently malicious. However, it creates a supply-chain weakness: a compromised upstream account, malicious future release, compromised package index, or unexpected incompatible release could be selected automatically. Python packages may execute build logic during installation, and their module-level code executes when imported by scripts/futures_data.py.

Because dependency integrity and provenance are not verified, review of this repository alone cannot establish the behavior of the effective runtime package set.

Attack Path

  1. An attacker compromises an upstream dependency release channel, maintainer account, or configured Python package index.
  2. The attacker publishes a malicious version satisfying akshare>=1.12 or pandas>=1.5.
  3. A user or automated skill installer runs the declared installation operation without a lock file or hashes.
  4. pip resolves and installs the attacker-controlled release.
  5. Malicious code executes during package build or installation, or when `scr ...[truncated 808 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace minimum-only constraints with exact, reviewed versions, for example:
    text
    akshare==REVIEWED_VERSION
pandas==REVIEWED_VERSION
  2. Generate and commit a lock file containing hashes, using a tool such as pip-compile --generate-hashes, Poetry, or an equivalent reproducible dependency manager.
  3. Install with hash enforcement:
    bash
    pip install --require-hashes -r requirements.txt
  4. Pin transitive dependencies as well as direct dependencies so the complete environment is reproducible.
  5. Use only a trusted package index and explicitly configure the index in controlled deployment environments.
  6. Review and test dependency updates before changing locked versions; automate vulnerability and provenance scanning in CI.
  7. Install and run the skill in an isolated virtual environment or container under a non-privileged account with minimal filesystem and network access.
  8. Update SKILL.md and references/README.md so that installation examples use the same locked and hash-verified dependency set.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

描述与代码存在明显不一致。代码确实覆盖了大量期货数据能力，如实时/历史行情、基差、席位、合约信息和费用信息，这与描述部分吻合。但有几处关键偏差：1) 描述提到“期权”数据，代码中没有任何期权相关接口；2) 描述提到“仓单数据”，CLI 分支里存在 receipt/receipt_gen 处理逻辑，但并没有对应函数加入 commands 映射，且代码片段中也未定义仓单获取函数，因此该能力实际上不可用；3) 代码额外提供了交易日历、保证金/手续费明细、主力合约列表、现货与股票关联数据，这些并未在声明中体现，属于未声明能力；4) 描述写“股期货、期权”，而代码实际主体是广义商品/金融期货数据封装，不是专门的股指期货与期权工具。综合来看，描述不能准确代表该代码块的真实行为，应判定为不匹配。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description and all user-facing documentation are written entirely in Chinese, with no indication that other languages are supported or that the Chinese-only presentation is an intentional, justified regional constraint. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This Python file contains user-facing natural-language documentation entirely in Chinese, including the script description, dependency notes, and usage examples. Because the file does not offer any language/locale choice or explain that the skill is intentionally China-region-specific, it creates a language policy issue for users who may not understand the instructions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The top-level docstring claims support for registered warehouse receipts, basis, member position rankings, fees and margin, trading calendar, and contract info, and gives examples like receipt, basis, position, fee, and contract. But the CLI command map only exposes a subset, and the dispatch logic references commands such as receipt, basis, position_dce, and commission that are not present in commands, making the documentation actively inconsistent with real behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a skill for futures and options real-time, historical, warehouse receipt, position, basis, contract, and fee-reference data. This function adds a separate '现货与股票关联' capability via ak.futures_spot_stock, which reaches into stock-association data not mentioned in the manifest and broader than the declared scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The skill name and description are entirely in Chinese, which can constitute a language policy issue when no user opt-in, multilingual alternative, or locale-specific justification is provided. In a manifest file, this natural-language constraint may limit accessibility or violate organizational expectations for language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The entire skill description, command guidance, and safety notes are written only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to Chinese-speaking users. Under the stated policy, a language or locale constraint should be optional or explicitly justified when imposed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.