ClawHub
Back to skill

Security audit

New Akshare Stock.Bak

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent China A-share market-data skill with some reliability and dependency-hardening issues, but no evidence of hidden access, persistence, exfiltration, or destructive behavior.

Install only in a virtual environment, treat outputs as informational rather than investment advice, and expect some commands or examples to need fixes before use. The most practical risks are dependency hygiene and script reliability, not hidden malicious behavior.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:10
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-13
Vulnerability Type: Unpinned dependency and insufficient supply-chain integrity controls
Risk Level: Medium

Vulnerable Code:

bash
Install dependencies:
```bash
pip install akshare
text

### Technical Analysis

The installation instructions retrieve the latest available version of `akshare` and its transitive dependencies without a version constraint, lock file, or package hash verification. Consequently, the code installed and executed by users can differ from the dependency version originally reviewed.

Package installation may execute build-system or installation logic. The package is also imported by both Python scripts, allowing malicious package initialization code to run with the privileges of the user invoking the Skill.

This is not evidence that the current AkShare package is malicious. The vulnerability is the absence of controls that ensure users receive a known, audited dependency artifact.

### Attack Path

1. An attacker compromises the upstream package, a maintainer account, the package publication process, or a transitive dependency.
2. The attacker publishes a malicious release that satisfies the unrestricted installation command.
3. A user follows the documented `pip install akshare` instruction.
4. The package manager resolves and installs the attacker-controlled release.
5. Malicious code executes during installation or when one of the project scripts imports `akshare`.

### Impact Assessment

Malicious dependency code could execute with the operating-system privileges of the user running `pip` or the stock-analysis scripts. Depending on those privileges, it could access user-readable files and credentials, alter files, make arbitrary network requests, or compromise the Python environment.

The scope is normally limited to the invoking user and accessible environment. If installation is performed with administra
...[truncated 87 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin AkShare to a specific, reviewed version rather than resolving the latest release.
  • Maintain a lock file that fixes all transitive dependency versions.
  • Record and verify cryptographic hashes, such as through a hash-locked requirements file and pip install --require-hashes.
  • Install dependencies from the official Python package index through a trusted HTTPS configuration.
  • Review dependency updates before modifying the lock file.
  • Run the Skill in a dedicated virtual environment under a non-administrative account.
  • Consider automated dependency vulnerability and provenance scanning in the release process.

Example hardened installation pattern:

bash
python -m pip install --require-hashes -r requirements.txt

T09 · Insecure Skill Coding Practices

Note
Location
scripts/stock_cli.py:58
Finding

User-Controlled Regular Expression in Stock Search

Content
View full analysis

Vulnerability Details

File Location: scripts/stock_cli.py, lines 58-63
Vulnerability Type: Regular-expression denial of service and unhandled regex syntax
Risk Level: Low

Vulnerable Code:

python
def search_stock(keyword):
    """Search for a stock."""
    df = ak.stock_zh_a_spot_em()
    # Fuzzy match against the stock code or name
    result = df[df['代码'].str.contains(keyword) | df['名称'].str.contains(keyword)]
    return result.head(10).to_dict(orient='records')

Technical Analysis

The --keyword command-line value reaches pandas.Series.str.contains without escaping or disabling regular-expression interpretation. The method uses regular expressions by default, so input intended as a literal stock code or name is instead parsed as a regex pattern.

A malformed pattern can raise a regex compilation exception and terminate the requested operation. A computationally expensive pattern can cause excessive backtracking and consume CPU time while it is evaluated against stock names and codes. The broad exception handler in main reports the failure but does not prevent availability loss for that invocation.

No code execution or privilege escalation is demonstrated by this flaw. Its practical effect is limited to search reliability and process availability.

Attack Path

  1. An attacker or untrusted caller controls the value passed through --keyword.
  2. The caller supplies malformed regex syntax or a pattern designed to trigger expensive backtracking.
  3. search_stock passes the value directly to both str.contains calls.
  4. The regex engine attempts to compile and evaluate the attacker-controlled pattern across the returned market-data columns.
  5. The search fails with an exception or consumes excessive processing time, delaying or denying completion of the CLI request.

Exploitation requires the ability to invoke the CLI or influence a wrapper that forwards untrusted input to i ...[truncated 443 chars]

Remediation
View remediation

Remediation Suggestions

Treat search terms as literal text and handle missing values explicitly:

python
def search_stock(keyword):
    """Search for a stock."""
    df = ak.stock_zh_a_spot_em()
    result = df[
        df['代码'].str.contains(keyword, regex=False, na=False)
        | df['名称'].str.contains(keyword, regex=False, na=False)
    ]
    return result.head(10).to_dict(orient='records')

If regular-expression searching is an intentional feature:

  • Make regex mode explicit and opt-in.
  • Validate pattern length and syntax before evaluation.
  • Reject patterns with dangerous complexity.
  • Apply execution time and resource limits when the CLI is exposed through a service.
  • Catch regex compilation errors separately and return a controlled validation message.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The overall domain matches the description at a high level: this is an A-share data utility built around AkShare. However, the declared description overstates the implemented functionality. The code supports quote retrieval, historical price/K-line retrieval, board/sector info, and stock search, which align with part of the description. But it does not contain any financial statement/data retrieval functions, any financial analysis routines, or any stock screening/selection logic. Additionally, the fund-flow action calls stock_individual_fund_flow(...) without the ak. namespace or any local definition, so that advertised capability is not actually functional in this code chunk. Therefore the description does not accurately represent the actual implemented behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script's description, help text, and runtime messages are all hard-coded in Chinese, such as the module docstring and multiple error/help strings. This imposes a specific language on all users without any opt-in or documented locale constraint, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

get_fund_flow 的文档字符串声明这是一个获取股票“资金流向”的AkShare数据函数，但实现中在 L054 调用了 stock_individual_fund_flow(...)，而不是前文统一使用的 ak.<function> 形式。按当前文件上下文，这个名称既未导入也未定义，因此实现无法按文档意图工作，构成注释/意图与实际代码行为的明显背离。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The description and title state the skill is specifically for A股 data and are written only in Chinese, which can amount to a locale-specific constraint without any explicit user opt-in or justification in the file. Under the policy, locale constraints should either be offered as a choice or clearly documented as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script's docstring, headings, status messages, and analysis text are all hard-coded in Chinese throughout the file. Because it does not offer any user opt-in or language selection, it imposes a specific language/locale in natural-language output, which matches the policy-violation criterion.

Content

No source excerpt is available for this finding.