T08 · Insecure Dependencies
Warning
- Location
SKILL.md:12- Finding
Unpinned AkShare Dependency Creates Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
New Akshare Stock.Bak2
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent A-share market-data helper with ordinary dependency and quality risks, but no evidence of hidden access, persistence, exfiltration, or destructive behavior.
Install only in a virtual environment or other isolated Python environment, consider pinning AkShare before use, and treat the included stock analysis as informational rather than investment advice. Expect Chinese-language output and be aware that the documented feature list is broader than the bundled scripts, with the fund-flow command likely needing a code fix.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/stock_cli.py:62- Finding
User-Controlled Regular Expression in Stock Search
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The code is broadly aligned with the description in that it is an A-share data utility based on AkShare and supports quote lookup, historical行情, board/sector information, and stock search. However, the description is broader than the supplied code: there is no implementation for financial statement retrieval or financial analysis, and no stock-screening logic. Additionally, the fund-flow function appears defective because it calls stock_individual_fund_flow without the ak. namespace or any local definition, so that advertised behavior likely fails at runtime. There is no evidence of unrelated or risky undeclared behavior beyond these scope/implementation gaps.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The markdown description, headings, and usage guidance are presented only in Chinese, which can impose a specific language/locale on users without offering an alternative or opt-in. The policy explicitly calls for flagging language or locale constraints when they are forced rather than optional or justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script's natural-language interface, labels, recommendations, and error messages are all hard-coded in Chinese, and there is no option for the user to select another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module description and user-facing messages are written only in Chinese, including the installation prompt and CLI help text context, with no indication that the tool is intentionally region- or locale-restricted. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
L053 的 docstring 将该函数描述为获取“资金流向”，但 L054 实际调用的是未加 ak. 前缀的 stock_individual_fund_flow，和本文件其余 AkShare 调用方式不一致。按当前代码，这一实现不会按文档所示执行资金流向查询，而是触发名称未定义错误，属于文档/意图与实际代码行为的直接偏离。
- Content