New Akshare Stock.Bak

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:31 PM UTC
• Version: 1.0.0

Overview

This is a coherent China A-share market-data skill with some reliability and dependency-hardening issues, but no evidence of hidden access, persistence, exfiltration, or destructive behavior.

Install only in a virtual environment, treat outputs as informational rather than investment advice, and expect some commands or examples to need fixes before use. The most practical risks are dependency hygiene and script reliability, not hidden malicious behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10
• Finding: Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 10-13 **Vulnerability Type**: Unpinned dependency and insufficient supply-chain integrity controls **Risk Level**: Medium **Vulnerable Code:** ```bash Install dependencies: ```bash pip install akshare ``` ``` ### Technical Analysis The installation instructions retrieve the latest available version of `akshare` and its transitive dependencies without a version constraint, lock file, or package hash verification. Consequently, the code installed and executed by users can differ from the dependency version originally reviewed. Package installation may execute build-system or installation logic. The package is also imported by both Python scripts, allowing malicious package initialization code to run with the privileges of the user invoking the Skill. This is not evidence that the current AkShare package is malicious. The vulnerability is the absence of controls that ensure users receive a known, audited dependency artifact. ### Attack Path 1. An attacker compromises the upstream package, a maintainer account, the package publication process, or a transitive dependency. 2. The attacker publishes a malicious release that satisfies the unrestricted installation command. 3. A user follows the documented `pip install akshare` instruction. 4. The package manager resolves and installs the attacker-controlled release. 5. Malicious code executes during installation or when one of the project scripts imports `akshare`. ### Impact Assessment Malicious dependency code could execute with the operating-system privileges of the user running `pip` or the stock-analysis scripts. Depending on those privileges, it could access user-readable files and credentials, alter files, make arbitrary network requests, or compromise the Python environment. The scope is normally limited to the invoking user and accessible environment. If installation is performed with administra ...[truncated 87 chars]
• Remediation: ## Remediation Suggestions - Pin AkShare to a specific, reviewed version rather than resolving the latest release. - Maintain a lock file that fixes all transitive dependency versions. - Record and verify cryptographic hashes, such as through a hash-locked requirements file and `pip install --require-hashes`. - Install dependencies from the official Python package index through a trusted HTTPS configuration. - Review dependency updates before modifying the lock file. - Run the Skill in a dedicated virtual environment under a non-administrative account. - Consider automated dependency vulnerability and provenance scanning in the release process. Example hardened installation pattern: ```bash python -m pip install --require-hashes -r requirements.txt ```

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/stock_cli.py:58
• Finding: User-Controlled Regular Expression in Stock Search## Vulnerability Details **File Location**: `scripts/stock_cli.py`, lines 58-63 **Vulnerability Type**: Regular-expression denial of service and unhandled regex syntax **Risk Level**: Low **Vulnerable Code:** ```python def search_stock(keyword): """Search for a stock.""" df = ak.stock_zh_a_spot_em() # Fuzzy match against the stock code or name result = df[df['代码'].str.contains(keyword) | df['名称'].str.contains(keyword)] return result.head(10).to_dict(orient='records') ``` ### Technical Analysis The `--keyword` command-line value reaches `pandas.Series.str.contains` without escaping or disabling regular-expression interpretation. The method uses regular expressions by default, so input intended as a literal stock code or name is instead parsed as a regex pattern. A malformed pattern can raise a regex compilation exception and terminate the requested operation. A computationally expensive pattern can cause excessive backtracking and consume CPU time while it is evaluated against stock names and codes. The broad exception handler in `main` reports the failure but does not prevent availability loss for that invocation. No code execution or privilege escalation is demonstrated by this flaw. Its practical effect is limited to search reliability and process availability. ### Attack Path 1. An attacker or untrusted caller controls the value passed through `--keyword`. 2. The caller supplies malformed regex syntax or a pattern designed to trigger expensive backtracking. 3. `search_stock` passes the value directly to both `str.contains` calls. 4. The regex engine attempts to compile and evaluate the attacker-controlled pattern across the returned market-data columns. 5. The search fails with an exception or consumes excessive processing time, delaying or denying completion of the CLI request. Exploitation requires the ability to invoke the CLI or influence a wrapper that forwards untrusted input to i ...[truncated 443 chars]
• Remediation: ## Remediation Suggestions Treat search terms as literal text and handle missing values explicitly: ```python def search_stock(keyword): """Search for a stock.""" df = ak.stock_zh_a_spot_em() result = df[ df['代码'].str.contains(keyword, regex=False, na=False) | df['名称'].str.contains(keyword, regex=False, na=False) ] return result.head(10).to_dict(orient='records') ``` If regular-expression searching is an intentional feature: - Make regex mode explicit and opt-in. - Validate pattern length and syntax before evaluation. - Reject patterns with dangerous complexity. - Apply execution time and resource limits when the CLI is exposed through a service. - Catch regex compilation errors separately and return a controlled validation message.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The overall domain matches the description at a high level: this is an A-share data utility built around AkShare. However, the declared description overstates the implemented functionality. The code supports quote retrieval, historical price/K-line retrieval, board/sector info, and stock search, which align with part of the description. But it does not contain any financial statement/data retrieval functions, any financial analysis routines, or any stock screening/selection logic. Additionally, the fund-flow action calls `stock_individual_fund_flow(...)` without the `ak.` namespace or any local definition, so that advertised capability is not actually functional in this code chunk. Therefore the description does not accurately represent the actual implemented behavior.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The script's description, help text, and runtime messages are all hard-coded in Chinese, such as the module docstring and multiple error/help strings. This imposes a specific language on all users without any opt-in or documented locale constraint, which matches the language/locale policy violation criteria.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: `get_fund_flow` 的文档字符串声明这是一个获取股票“资金流向”的AkShare数据函数，但实现中在 L054 调用了 `stock_individual_fund_flow(...)`，而不是前文统一使用的 `ak.<function>` 形式。按当前文件上下文，这个名称既未导入也未定义，因此实现无法按文档意图工作，构成注释/意图与实际代码行为的明显背离。

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: The description and title state the skill is specifically for A股 data and are written only in Chinese, which can amount to a locale-specific constraint without any explicit user opt-in or justification in the file. Under the policy, locale constraints should either be offered as a choice or clearly documented as region-specific.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The script's docstring, headings, status messages, and analysis text are all hard-coded in Chinese throughout the file. Because it does not offer any user opt-in or language selection, it imposes a specific language/locale in natural-language output, which matches the policy-violation criterion.

Static analysis

No suspicious patterns detected.